SecBoard
Zurück zur CVE-Übersicht

CVE-2026-97381

CRITICAL(9.9)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.9 — Kritisch

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.9

Technische Schwere

Beschreibung

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 1.13.2

Threat-Hunting-Queries

Detection for ActiveX control instantiation from untrusted domains in Internet Explorer. This requires logging of ActiveX control usage and potentially network traffic analysis for unusual update requests.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName == "iexplore.exe"
| where ProcessCommandLine contains "LegacyUpdateCtrl.dll"
| where not (InitiatingProcessCommandLine contains "legacyupdate.net" or InitiatingProcessCommandLine contains "test.legacyupdate.net")

Splunk SPL

index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 | Image="C:\Program Files\Internet Explorer\iexplore.exe" | CommandLine="*LegacyUpdateCtrl.dll*" | NOT (CommandLine="*legacyupdate.net*" OR CommandLine="*test.legacyupdate.net*")

Sigma

title: Legacy Update ActiveX Control Untrusted Access
status: experimental
description: Detects attempts to access the Legacy Update ActiveX control from untrusted domains in Internet Explorer.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\iexplore.exe'
    CommandLine|contains: 'LegacyUpdateCtrl.dll'
  filter:
    CommandLine|contains:
      - 'legacyupdate.net'
      - 'test.legacyupdate.net'
  condition: selection and not filter
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
tags:
  - attack.defense_evasion
  - attack.t1204.001

Elastic ES|QL

from process where process.executable : "*\\iexplore.exe" and process.command_line : "*LegacyUpdateCtrl.dll*" and not (process.command_line : "*legacyupdate.net*" or process.command_line : "*test.legacyupdate.net*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (2)

  • legacyupdate.net
  • test.legacyupdate.net

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen