CVE-2019-1405: Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

CVE-2019-1405 is a privilege-escalation vulnerability in the Microsoft Windows Universal Plug and Play (UPnP) service. It allows an attacker who already has a foothold on a system to gain higher privileges by abusing how that service handles COM object creation. Because privilege escalation is a common step after initial access, and because this issue has been tied to ransomware activity, it matters for any organization running Windows endpoints or servers where the UPnP service is present.

Defenders should treat it as a local elevation path that can turn a limited compromise into full system control. Confirm exact affected builds, patches, and any configuration notes directly against the Microsoft advisory; do not rely on secondary summaries alone.

How it works

The core issue is improper handling inside the Windows UPnP service that permits COM object creation in a way that elevates privileges. In practical terms, an attacker who can already run code at a lower integrity level abuses this service behavior to obtain higher privileges on the same host.

This is a classic local privilege-escalation pattern: the vulnerable service runs with elevated rights and fails to adequately restrict what objects or actions a less-privileged caller can trigger. Public detail on the precise COM interfaces or call sequences is limited here; treat any exploit write-ups as unconfirmed until validated against the vendor advisory and your own testing. The attacker still needs prior code execution or a way to interact with the service, so this vulnerability is typically chained after phishing, malware droppers, or other initial-access methods rather than used as a remote wormable entry point by itself.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that include the Universal Plug and Play service. UPnP is commonly present on client and server SKUs, though it may be disabled or firewalled in hardened environments. Inventory is straightforward:

• Enumerate Windows hosts via your asset management, CMDB, or endpoint management platform and note OS build and patch level.
• Check whether the UPnP-related services (commonly SSDP Discovery and UPnP Device Host) are installed and running; use services.msc, PowerShell Get-Service, or equivalent configuration-management queries.
• Compare installed updates against the Microsoft security update that addresses CVE-2019-1405; the exact KB and applicable builds must be confirmed in the vendor advisory.
• Review group policy and local security baselines for any intentional enablement of UPnP on servers or high-value workstations where it is rarely needed.

Telemetry signs of exploitation are those typical of local privilege escalation: unexpected process creation or token manipulation originating from UPnP-related processes, unusual COM activation patterns, or post-exploitation actions (credential dumping, lateral movement tools, ransomware staging) running as SYSTEM or high-integrity shortly after lower-privilege activity. Correlate EDR alerts for privilege-escalation techniques with hosts that still lack the relevant update. Absence of clear IoCs does not prove safety; patch status remains the primary indicator.

How to remediate

Apply the Microsoft security update that resolves CVE-2019-1405 as directed in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; prioritize systems that are internet-facing, run untrusted code, or hold sensitive data.

• Deploy the patch through your normal WSUS, SCCM/ConfigMgr, Intune, or other patch-management pipeline; verify installation via update history or compliance reports.
• After patching, reboot if required by the update and confirm the UPnP service binaries or related components reflect the fixed version.
• Where UPnP is not required for business function, disable the UPnP Device Host and SSDP Discovery services and block inbound SSDP/UPnP traffic at host and network firewalls as lasting hardening.
• Re-validate privileged-access workstations and jump hosts first; elevation bugs are especially dangerous on admin systems.

Document the change and retain evidence of patch compliance for audit and incident-response readiness.

If you can't patch immediately

If immediate patching is blocked by change windows or compatibility testing, reduce risk with compensating controls while you schedule the update:

• Disable the UPnP Device Host and SSDP Discovery services on systems that do not need them; this removes the vulnerable attack surface for many hosts.
• Segment networks so that endpoints that must keep UPnP enabled cannot easily reach high-value servers; restrict lateral movement paths.
• Enforce application control and least-privilege policies so that untrusted users and processes cannot easily launch the initial code that would abuse the elevation path.
• Increase monitoring on remaining unpatched hosts: alert on privilege-escalation behaviors, unusual service interactions, and ransomware precursors (mass file encryption, shadow-copy deletion, suspicious scheduled tasks).
• Virtual patching via EDR or host firewall rules that constrain COM activation or UPnP-related process behavior can buy time, but it is not a substitute for the official update.

Track every exception and set a firm deadline to patch; known ransomware use raises the cost of delay.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities are frequently used after initial access to deploy ransomware or steal data. If you discover exploitation or have unpatched systems that showed suspicious elevation activity, follow your incident-response plan: isolate affected hosts, preserve forensic images, reset credentials that may have been accessed from the elevated context, and hunt for persistence and lateral movement. Organizations and individuals can also run a free exposure scan of their email addresses against known breach data sets to check whether credentials or personal information have already appeared in public breach corpora, then force password changes and enable multi-factor authentication where exposure is confirmed.