{"uuid": "b01b6bb4-4ffd-4930-84e6-ab3169a236ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-1405", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/comahawk.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x64\", \"author\": [\"NCC Group\", \"hoangprod\", \"bwatters-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This exploit uses two vulnerabilities to execute a command as an elevated user.\\n          The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to\\n          NT AUTHORITY\\\\LOCAL SERVICE\\n          The second (CVE-2019-1322) leverages the Update Orchestrator Service to\\n          elevate from NT AUTHORITY\\\\LOCAL SERVICE to NT AUTHORITY\\\\SYSTEM.\", \"disclosure_date\": \"2019-11-12\", \"fullname\": \"exploit/windows/local/comahawk\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"Microsoft UPnP Local Privilege Elevation Vulnerability\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/local/comahawk.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/local/comahawk\", \"references\": [\"CVE-2019-1322\", \"CVE-2019-1405\", \"EDB-47684\", \"URL-https://github.com/apt69/COMahawk\", \"URL-https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2019/november/cve-2019-1405-and-cve-2019-1322-elevation-to-system-via-the-upnp-device-host-service-and-the-update-orchestrator-service/\", \"URL-https://fortiguard.com/threat-signal-report/3243/new-proof-of-concept-combining-cve-2019-1322-and-cve-2019-1405-developed-1\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:07.340680Z"}