Actively exploited · Published Apr 14, 2015 · Assigned by microsoft

CVE-2015-1635

Critical 9.8 Exploited

In plain English

A critical-severity code injection in HTTP.sys from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on February 10, 2022). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)100.0%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Feb 10, 2022

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Aug 10, 2022.

Official description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

MS15-034 vendor-advisory, x_refsource_MS
36773 exploit, x_refsource_EXPLOIT-DB
120629 vdb-entry, x_refsource_OSVDB
1032109 vdb-entry, x_refsource_SECTRACK
74013 vdb-entry, x_refsource_BID
36776 exploit, x_refsource_EXPLOIT-DB
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635 government-resource