PT-2019-4227 · Microsoft+1 · Windows Certificate Dialog+2

Eduardo Braun Prado · Publicado 2019-11-12 · Atualizado 2026-03-10 · CVE-2019-1388

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Certificate Dialog (affected versions not specified) Nvidia Control Panel (affected versions not specified)

Description An elevation of privilege issue exists due to improper enforcement of user privileges. This allows attackers to potentially elevate their privileges. The vulnerability is related to insufficient access control in the Windows Certificate Dialog. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Windows Certificate Dialog, consider restricting access to sensitive features until a patch is available. For Nvidia Control Panel, as a temporary workaround, consider disabling any features that may be related to privilege escalation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BDU:2019-04826

CVE-2019-1388

ZDI-19-975

Produtos afetados

Nvidia Control Panel

Windows

Windows Certificate Dialog

Referências · 21

• 🔥 https://github.com/jas502n/CVE-2019-1388 · Exploit
• 🔥 https://github.com/sv3nbeast/CVE-2019-1388 · Exploit
• 🔥 https://github.com/nobodyatall648/CVE-2019-1388 · Exploit
• 🔥 https://github.com/suprise4u/CVE-2019-1388 · Exploit
• https://osv.dev/vulnerability/CVE-2019-1388 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-975 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1388 · Nota de Segurança
• https://t.me/malwr/2229 · Publicação no Telegram
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-1388 · Aviso do Fabricante
• https://twitter.com/_KScorpio/status/1764527998269599991 · Publicação no Twitter
• https://t.me/aptreports/24372 · Publicação no Telegram
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• https://bdu.fstec.ru/vul/2019-04826 · Nota de Segurança
• https://tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388 · Nota de Segurança, Aviso do Fabricante