CVE-2020-1598: Windows UPnP Service Elevation of Privilege Vulnerability

Overview

Severity

Medium (CVSS 4.6)

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2020-Sep

Released

2020-09-08

EPSS Score

1.05% (percentile: 77.6%)

Description

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows UPnP service handles objects in memory.

Affected Products (44)

Other

• 11497
• 11498
• 11563
• 11568
• 11569
• 11570
• 11571
• 11572
• 11712
• 11713
• 11714
• 11715
• 11453
• 11454
• 11583
• 11644
• 11645
• 11646
• 11647
• 11766
• 11767
• 11768
• 11769
• 10729
• 10735
• 10852
• 10853
• 10816
• 10855
• 10047
• 10048
• 10481
• 10482
• 10484
• 9312
• 10287
• 9318
• 9344
• 10051
• 10049
• 10378
• 10379
• 10483
• 10543

Security Updates (15)

• 4577032
• 4570333
• 4574727
• 4577041
• 4571756
• 4577049
• 4577015
• 4577051
• 4577053
• 4577066
• 4577071
• 4577064
• 4577070
• 4577038
• 4577048

Acknowledgments

Yuki Chen

Revision History

• 2020-09-08: Information published.