CVE-2019-18279

Vulnerability

Phoenix SCT WinFlash versions 1.1.12.0 through 1.5.74.0 include drivers that provide low-level access to system components for firmware updates and diagnostics. These drivers can be abused by a malicious Windows application to gain elevated privileges. The vulnerability stems from the drivers' ability to perform privileged operations without proper access control, allowing user-mode applications to escalate to kernel-level privileges [1].

Exploitation

An attacker with user-level access to a Windows system can load the vulnerable signed driver and use its functionality to read and write kernel memory or execute privileged commands. No additional authentication or user interaction beyond initial access is required. The attacker must have the ability to load a driver (which is possible with standard user privileges if the driver is already present or can be installed) [1].

Impact

Successful exploitation grants the attacker SYSTEM or kernel-level privileges, enabling full compromise of the Windows environment. This includes the ability to disable security software, install persistent malware, and access sensitive data. There is no known direct impact on UEFI firmware [1].

Mitigation

Phoenix Technologies fixed this vulnerability in late June 2019. Users should update WinFlash to a version later than 1.5.74.0. No workaround is available for unpatched versions. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].