IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.6Media KEV

CVE-2015-1769Microsoft Windows Mount Manager Privilege Escalation Vulnerability

microsoft windows 10; microsoft windows 7; microsoft windows 8; microsoft windows 8.1 Publicada: (hace 11 años)

Explotación conocida — Microsoft Windows Mount Manager Privilege Escalation Vulnerability

CISA confirmó el 25.05.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.06.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2015-1769

Descripción

Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Mount Manager Elevation of Privilege Vulnerability."

Debilidad (CWE): CWE-264

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
microsoft windows 10 —
microsoft windows 7 —
microsoft windows 8 —
microsoft windows 8.1 —
microsoft windows rt —
microsoft windows rt 8.1 —
microsoft windows server 2008 r2
microsoft windows server 2012 r2
microsoft windows vista —

Referencias y parches

Coincidencias CPE (NVD) (12)
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

CVE recientes del mismo producto — Windows 10

7.0Alta
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Media
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS