Security readout for executives and security teams
Plain-English summary
CVE-2011-2005 lets a local user or crafted application gain higher privileges on affected legacy Windows systems. It targets the Windows Ancillary Function Driver, a kernel component. Because CISA lists it in KEV, treat remaining Windows XP or Server 2003 systems as urgent legacy risk.
Executive priority
High priority for any organization with legacy Windows assets. KEV listing means this is not theoretical, and successful exploitation can turn limited access into full system compromise on affected hosts.
Technical view
afd.sys improperly validates user-mode input before passing it into kernel mode. The published affected scope is Microsoft Windows XP SP2/SP3 and Windows Server 2003 SP2. The issue is local elevation of privilege, not described as remote code execution in the provided sources.
Likely exposure
Exposure is limited to environments still running Windows XP SP2/SP3 or Windows Server 2003 SP2, including embedded, lab, industrial, or legacy business systems. If those platforms are absent, practical exposure is unlikely.
Exploitation context
CISA KEV status supports known exploitation. The source description requires local interaction through a crafted application, so the primary risk is privilege escalation after an attacker already has code execution or local access.
Researcher notes
The evidence supports local privilege escalation in afd.sys with affected legacy Windows versions and known exploitation via KEV. The provided bundle does not include exploit mechanics, affected third-party products, or detailed compensating controls.
Mitigation direction
- Apply Microsoft MS11-080 guidance and security updates where applicable.
- Inventory and remove unsupported Windows XP and Server 2003 systems.
- Isolate affected legacy systems until patch status is confirmed.
- Prioritize remediation according to CISA KEV handling expectations.
- Check vendor guidance if standard patching is unavailable.
Validation and detection
- Identify hosts running Windows XP SP2/SP3 or Server 2003 SP2.
- Verify MS11-080 installation through patch management records.
- Use the referenced OVAL definition for vulnerability assessment where supported.
- Confirm no affected legacy hosts remain in production networks.
- Review exception lists for embedded or isolated Windows systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2011-2005 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- oval:org.mitre.oval:def:13114CVE reference · vdb-entry, signature
- MS11-080CVE reference · vendor-advisory, x_refsource_MS
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2005CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.