Security readout for executives and security teams
Plain-English summary
CVE-2018-6633 is a local crash risk in Micropoint proactive defense software. A vulnerable driver can mishandle input and allow a local user to force a Windows blue screen. Sources do not confirm remote exploitation, active exploitation, a vendor patch, or the nature of the “unspecified other impact.”
Executive priority
Treat this as a targeted endpoint stability risk, not a confirmed internet-scale emergency. Prioritize inventory and vendor-status checks, especially where affected machines support critical operations or allow multiple local users.
Technical view
Micropoint proactive defense software 2.0.20266.0146 includes mp110005.sys, which does not validate input values for IOCTL 0x80000038. The documented impact is local denial of service through BSOD, with possible unspecified additional impact. No CVSS, CWE, CPE, or vendor remediation details are provided in the source bundle.
Likely exposure
Exposure appears limited to Windows systems running Micropoint proactive defense software 2.0.20266.0146 with the mp110005.sys driver installed. The documented attack condition requires local user access, so shared endpoints, kiosk systems, and multi-user servers are the most relevant review targets.
Exploitation context
The CVE is not listed as CISA KEV in the supplied data. A public GitHub reference is listed and appears to contain proof-of-concept material, but the source bundle does not establish active exploitation in the wild.
Researcher notes
The record is sparse: affected vendor/product fields are not normalized, severity is unknown, and the “unspecified other impact” is not defined. Analysis should stay bounded to local DoS unless additional vendor or researcher evidence supports broader impact.
Mitigation direction
- Identify systems running Micropoint proactive defense software 2.0.20266.0146.
- Check Micropoint or vendor guidance for fixed versions or replacement advice.
- Remove or disable the vulnerable product where operationally acceptable.
- Restrict local interactive access on affected systems.
- Prioritize shared or high-availability systems where BSOD impact is material.
Validation and detection
- Confirm whether mp110005.sys is present on candidate Windows systems.
- Verify installed Micropoint proactive defense software version against 2.0.20266.0146.
- Review endpoint crash history for BSOD events involving mp110005.sys.
- Check whether untrusted users can log in locally to affected systems.
- Record remediation status because no structured CPE data is supplied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-6633 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000038CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.