{"id":"CVE-2014-4076","published":"2014-11-11T22:00:00Z","modified":"2024-08-06T11:04:28Z","title":"Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka \"TCP/IP Elevation of Privilege Vulnerability.\"","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an elevation of privilege vulnerability in the TCP/IP driver components of Microsoft Windows Server 2003 SP2, specifically tcpip.sys and tcpip6.sys. An attacker who already has local user access can craft a malicious IOCTL call to these drivers to gain elevated privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:54Z"},"cvss":null,"epss":{"score":0.22666,"percentile":0.97713,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2016-08-04","exploitedFirstSeen":"2016-08-04","ransomware":false,"evidence":[{"url":"https://www.recordedfuture.com/russian-apt-toolkits","date":"2016-08-04"},{"url":"https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/","date":"2019-12-05"},{"url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","date":"2021-01-21"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.logpoint.com/wp-content/uploads/2024/06/logpoint-etpr-forest-blizzard.pdf","date":"2024-05-31"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"2015: Malware Analysis Report","url":"https://otx.alienvault.com/pulse/69f4dfa6405cf7858f1b732a","created":"2026-05-01"},{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"CVE -CVE Reference Map for Source MS - Curios RE active candidates CVE version 20061101","url":"https://otx.alienvault.com/pulse/679c3446de4f362fac9217f9","created":"2025-01-31"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-070","tags":["vendor-advisory","x_refsource_MS"]},{"url":"http://www.osvdb.org/114532","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"https://www.exploit-db.com/exploits/37755/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.exploit-db.com/exploits/35936","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.securityfocus.com/bid/70976","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-775eef49c70c361c67f1","title":"Bitdefender In depth analysis of APT28–The Political Cyber Espionage","publisher":"download.bitdefender.com","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf","date":null,"mentions":[{"quote":"(78450806E56B1F224D00455EFCD04CE3) features a hardcoded path to a debug file (C:\\Users\\Пользователь\\Desktop\\cve-2014-4076\\","start":6183,"end":6305},{"quote":"cve-19abdba\\Debug\\CVE-2014-4076.pdb).","start":6307,"end":6344},{"quote":"A tool that exploits a privilege escalation vulnerability (CVE-2014-4076) to gain system privileges (xp.exe)","start":10949,"end":11057},{"quote":"A tool that exploits a privilege escalation vulnerability (CVE-2014-4076) to gain system privileges (xp.exe)","start":15051,"end":15159},{"quote":"The tool is built around a vulnerability discovered in 2014 (CVE-2014-4076) and works by sending a specially crafted package to the \\\\.\\\\","start":28490,"end":28627}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-4007","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-4007","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":35936,"url":"https://www.exploit-db.com/exploits/35936","title":"Microsoft Windows Server 2003 SP2 - Local Privilege Escalation (MS14-070)","type":"local","platform":"windows","date":"2015-01-29","verified":false,"provenance":"source"},{"id":37755,"url":"https://www.exploit-db.com/exploits/37755","title":"Microsoft Windows Server 2003 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)","type":"local","platform":"windows","date":"2015-08-12","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2015-01-29"},"pocGithub":{"count":1,"skipped":0,"earliest":"2015-08-20","earliestUrl":"https://github.com/fungoshacks/CVE-2014-4076","repos":[{"name":"fungoshacks/CVE-2014-4076","url":"https://github.com/fungoshacks/CVE-2014-4076","stars":0,"created":"2015-08-20"}]},"metasploit":[{"name":"MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference","module":"exploit/windows/local/ms14_070_tcpip_ioctl","type":"exploit","disclosureDate":"2014-11-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb"}],"first":{"date":"2014-11-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/37755/","http://www.exploit-db.com/exploits/35936"],"flow":[{"stage":"related","techniques":["T1608"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2014-11-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2014-4076","provenance":"source"},{"date":"2014-11-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-01-29, PoC-in-GitHub 2015-08-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb","provenance":"source"},{"date":"2016-08-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.recordedfuture.com/russian-apt-toolkits","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":64.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3738 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.54,"detail":"percentile 0.9771"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}