Vulnerability record · CVE-2015-2291 · published 9 August 2017
CVE-2015-2291: Intel Ethernet Diagnostics Driver IOCTL Input Validation Flaw
Intel · Ethernet Diagnostics Driver Iqvw32.Sys
IQVW32.sys and IQVW64.sys before 1.3.1.0, the Intel Ethernet diagnostics driver for Windows, fail to properly validate input on several IOCTL calls. A local user can trigger a denial of service or potentially execute code with kernel privileges.
Description
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with known ransomware use and public exploit code, though exploitation requires local access.
What it is
IQVW32.sys and IQVW64.sys before 1.3.1.0, the Intel Ethernet diagnostics driver for Windows, fail to properly validate input on several IOCTL calls. A local user can trigger a denial of service or potentially execute code with kernel privileges.
Impact
An attacker with local access can crash the system or gain kernel-level code execution, which typically means full control of the host. This elevates a low-privileged local user to kernel privileges.
Attack surface
Reached locally by sending crafted IOCTL calls (0x80862013, 0x8086200B, 0x8086200F, 0x80862007) to the driver. The CVSS vector shows low privileges required and no user interaction.
Exploitation
CISA added it to KEV on 2023-02-10 with known ransomware campaign use, and public exploit code exists on Exploit-DB; EPSS 30-day probability is about 9%.
What to do
- Update the Intel Ethernet diagnostics driver to 1.3.1.0 or later per Intel advisory INTEL-SA-00051.
- Remove or disable the IQVW32.sys/IQVW64.sys driver where it is not required.
- Restrict local interactive and service account access on systems that must retain the driver.
- Monitor for and block known exploit tooling that targets these IOCTL codes.
Detection
- Alert on processes issuing IOCTL codes 0x80862013, 0x8086200B, 0x8086200F or 0x80862007 to IQVW32.sys/IQVW64.sys.
- Monitor for unexpected driver loads of IQVW32.sys or IQVW64.sys and check their file versions.
- Watch for kernel crash or bugcheck events correlated with local diagnostic driver activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2015-2291 to the Known Exploited Vulnerabilities catalog on 10 February 2023 as "Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 3 March 2023.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/130854/Intel-Network-Adapter-Diagnostic-Driver-IOCTL-DoS.html | Third Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/79623 | Broken LinkThird Party AdvisoryVDB Entry |
| https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/36392/ | Third Party AdvisoryVDB Entry |
| http://packetstormsecurity.com/files/130854/Intel-Network-Adapter-Diagnostic-Driver-IOCTL-DoS.html | Third Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/79623 | Broken LinkThird Party AdvisoryVDB Entry |
| https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr | PatchVendor Advisory |
| https://www.exploit-db.com/exploits/36392/ | Third Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2291 | US Government Resource |
Track CVE-2015-2291 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2291), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
