Analyst readout for executives and security teams
Plain-English summary
This flaw affects a Micropoint Proactive Defense kernel driver and can let a local user crash the machine with a blue screen. The sources do not confirm remote exploitation, active exploitation, a CVSS score, or a vendor fix.
Executive priority
Treat this as a targeted endpoint stability risk, not confirmed internet-facing compromise. Prioritize if the software is deployed on critical systems or multi-user environments, and verify vendor remediation because the provided sources do not name a patch.
Technical view
CVE-2018-6629 is an input-validation issue in mp110005.sys in Micropoint Proactive Defense Software 2.0.20266.0146. Local users can trigger denial of service through IOCTL 0x80000118, with unspecified other impact mentioned but not detailed in the sources.
Likely exposure
Exposure appears limited to Windows systems running Micropoint Proactive Defense Software 2.0.20266.0146 with the mp110005.sys driver installed. The source bundle does not identify CPEs or broader affected versions.
Exploitation context
The CVE is not listed as KEV, so the provided evidence does not support active exploitation. A public GitHub reference exists, indicating proof-of-concept material may be available, but the source summary only supports local denial of service.
Researcher notes
Evidence is sparse. The CVE text names the vulnerable driver, product version, IOCTL value, and local denial-of-service outcome, but does not provide CVSS, CWE, CPEs, patch status, or confirmed privilege escalation details.
Mitigation direction
- Inventory systems for Micropoint Proactive Defense Software 2.0.20266.0146.
- Check Micropoint or vendor guidance for fixed versions or removal recommendations.
- Prioritize remediation on shared workstations, servers, and systems with many local users.
- Limit unnecessary local interactive access until vendor guidance is confirmed.
- Monitor affected systems for crashes involving mp110005.sys.
Validation and detection
- Confirm whether mp110005.sys is present on managed Windows endpoints.
- Verify installed Micropoint Proactive Defense version against 2.0.20266.0146.
- Review crash records for BSOD events naming mp110005.sys.
- Check whether affected hosts permit untrusted local users.
- Document any vendor advisory or fixed build found during follow-up.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-6629 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000118CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.