CVE-2015-6132

EPSS 84.7%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (15 stars) — exploitation code widely available.

CVSS —EPSS 84.7%KEV nãoPoC públicaNuclei —Metasploit simPatch referenciado

Lifecycle

08 Dec 2015Metasploit module available

08 Dec 2015Public PoC

09 Dec 2015Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."

Affected products

n/a · n/a

public PoCs found — 4

githubgithub.com/hexx0r/CVE-2015-6132★ 15 cve_referencewww.exploit-db.com/exploits/38968/unverified exploitdbwww.exploit-db.com/exploits/41706unverified exploitdbwww.exploit-db.com/exploits/38968unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-132 https://www.exploit-db.com/exploits/38968/http://www.securitytracker.com/id/1034338