CVE-2025-27484: Windows 10 1507 UPnP Privilege Escalation

CVE-2025-27484 Overview

CVE-2025-27484 affects the Windows Universal Plug and Play (UPnP) Device Host service across supported Windows client and server releases. The flaw involves sensitive data placed in improperly locked memory, classified under [CWE-591]. An authorized network attacker can leverage this condition to elevate privileges on the target system. Microsoft published the advisory on April 8, 2025, and the entry was last modified on July 8, 2025. The CVSS 3.1 vector indicates network attack reachability with high attack complexity and low privilege requirements, with high impact to confidentiality, integrity, and availability.

Critical Impact
An authenticated remote attacker can read sensitive in-memory data from the UPnP Device Host service and use it to escalate privileges across the network.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-04-08 - CVE-2025-27484 published to NVD
2025-04-08 - Microsoft releases security advisory and patch guidance
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-27484

Vulnerability Analysis

The vulnerability resides in the Windows UPnP Device Host, the service responsible for hosting UPnP devices and handling Simple Service Discovery Protocol (SSDP) and SOAP traffic. The service stores sensitive runtime data in memory regions that are not locked against paging or unauthorized read access. An attacker with valid network credentials can interact with the UPnP Device Host to trigger conditions that expose this data.

Exploitation yields high impact across confidentiality, integrity, and availability. The CWE-591 classification indicates the underlying defect is the storage of sensitive information in memory that is not properly protected through locking primitives such as VirtualLock or secure heap mechanisms.

Root Cause

The UPnP Device Host service places privileged data, such as authentication material or service tokens, in pageable memory without enforcing memory locking. Memory that is not locked may be swapped to disk or read by other processes that can interact with the service. Combined with weak boundary checks in the service's network-facing handlers, this allows an authenticated attacker to influence which memory contents are exposed.

Attack Vector

The attack vector is network-based with high complexity. The attacker must already hold low-level privileges on the network to reach the UPnP Device Host endpoint. After authenticating, the attacker issues crafted UPnP requests that cause the service to expose contents of improperly locked memory. The leaked data is then reused to authenticate as a higher-privileged principal, completing the elevation of privilege chain.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2025-27484 Advisory for vendor-specific technical detail.

Detection Methods for CVE-2025-27484

Indicators of Compromise

Unexpected authenticated SOAP or SSDP requests directed at the UPnP Device Host service on TCP port 2869 or UDP port 1900.
New or unusual privilege assignments to accounts that recently interacted with the UPnP service.
Anomalous process activity from upnphost.dll hosted within svchost.exe instances handling the UPnP service group.

Detection Strategies

Monitor Windows Security and System event logs for authentication events followed by privilege escalation events on hosts running the UPnP Device Host service.
Inspect network telemetry for repeated or malformed UPnP control requests originating from authenticated internal sources.
Correlate service crashes or restarts of the UPnP Device Host with subsequent lateral movement attempts.

Monitoring Recommendations

Enable detailed auditing for the SSDPSRV and upnphost services and forward logs to a central SIEM.
Track changes to membership of privileged groups across affected Windows servers and clients.
Baseline normal UPnP traffic in enterprise segments and alert on deviations, especially server-to-server UPnP activity.

How to Mitigate CVE-2025-27484

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2025-27484 Advisory to all affected Windows client and server builds.
Inventory systems running the UPnP Device Host service and prioritize patching for servers and domain-joined workstations.
Restrict network reachability to UPnP service ports from untrusted network segments using host and perimeter firewalls.

Patch Information

Microsoft addressed CVE-2025-27484 through cumulative security updates issued on April 8, 2025. Updates are available for Windows 10 (1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008 through 2025. Administrators should consult the vendor advisory for the specific KB articles applicable to each supported build.

Workarounds

Disable the UPnP Device Host service (upnphost) on systems that do not require UPnP functionality.
Block inbound traffic to TCP port 2869 and UDP port 1900 at network boundaries and on host firewalls where UPnP is not required.
Limit accounts that can authenticate to the UPnP Device Host endpoint and remove unnecessary network logon rights.

bash

# Disable the UPnP Device Host service on Windows
sc.exe config upnphost start= disabled
sc.exe stop upnphost

# Block UPnP ports at the host firewall
netsh advfirewall firewall add rule name="Block UPnP TCP 2869" dir=in action=block protocol=TCP localport=2869
netsh advfirewall firewall add rule name="Block UPnP UDP 1900" dir=in action=block protocol=UDP localport=1900