{"id":"CVE-2015-2291","kind":"vulnerability","aliases":["CVE-2015-2291"],"related":[],"title":"(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows…","description":"(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.","summary":"Intel's Ethernet Diagnostics Driver for Windows (IQVW32.sys and IQVW64.sys) has an unspecified flaw that lets an attacker crash the system with a denial-of-service. CISA lists it as actively exploited, and the KEV entry notes ransomware use.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-02-10T00:00:00+00:00","products":[{"name":"Intel Ethernet Diagnostics Driver for Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"intel ethernet diagnostics driver iqvw32.sys","fixed":[],"affected":"= 1.03.0.7","ecosystem":"vendor"},{"name":"intel ethernet diagnostics driver iqvw64.sys","fixed":[],"affected":"= 1.03.0.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","intel-ethernet","ransomware","self-hosted","windows"],"not_affected_if":["no-iqvw-driver-installed"],"how_to_check":"Search Windows for IQVW32.sys or IQVW64.sys (e.g. dir C:\\Windows\\System32\\drivers\\IQVW*.sys) and check whether the Intel diagnostics package is installed.","fix":"Apply updates per vendor instructions (Intel advisory); remove the driver if it is not needed.","status":"open","published_at":"2017-08-09T18:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:42+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:08:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions (Intel advisory); remove the driver if it is not needed.\nunknown","reach":"local","impact":"low","summary":"Intel's Ethernet Diagnostics Driver for Windows (IQVW32.sys and IQVW64.sys) has an unspecified flaw that lets an attacker crash the system with a denial-of-service. CISA lists it as actively exploited, and the KEV entry notes ransomware use.","category":"infrastructure","who_cares":["windows","intel-ethernet","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes Windows host via kernel driver; denial of service","analyst_note":"Confirm the affected driver versions, fixed version and removal guidance from Intel's advisory and the CISA KEV entry; the sources do not give them.","how_to_check":"Search Windows for IQVW32.sys or IQVW64.sys (e.g. dir C:\\Windows\\System32\\drivers\\IQVW*.sys) and check whether the Intel diagnostics package is installed.\nunknown","needs_analyst":true,"not_affected_if":["no-iqvw-driver-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000514,"input_tokens":2845,"output_tokens":458,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2015':19A,22A '-2291':20A,23A '0x80862007':135C '0x8086200b':130C '0x8086200f':132C '0x80862013':128C '1':1A,90C '1.3.1.0':4A,9A,93C,98C '2':6A,95C 'activ':81B 'allow':107C 'arbitrari':119C 'attack':67B 'b':129C 'c':131C 'call':137C 'caus':111C 'cisa':77B 'code':120C 'craft':126C 'crash':68B 'cve':18A,21A 'd':134C 'denial':74B,113C 'denial-of-servic':73B 'diagnost':14A,53B,103C 'diagnostics':26A,32A,37A 'driver':15A,27A,33A,38A,54B,104C 'entri':86B 'ethernet':13A,25A,31A,36A,44B,52B,102C 'execut':118C 'exploit':40B,82B 'flaw':63B 'for':28A 'host':48B 'infrastructur':41B 'intel':12A,24A,30A,35A,43B,50B,101C 'intel-ethernet':42B 'ioctl':136C 'iqvw32.sys':2A,34A,57B,91C 'iqvw64.sys':7A,39A,59B,96C 'kernel':122C 'kev':85B 'let':65B 'list':78B 'local':108C 'note':87B 'possibl':117C 'privileg':123C 'ransomwar':45B,88B 'self':47B 'self-host':46B 'servic':76B,115C 'system':70B 'unspecifi':62B 'use':89B 'user':109C 'via':124C 'window':17A,49B,56B,106C 'windows':29A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-08-09T18:29:00+00:00","kev":{"dateAdded":"2023-02-10","dueDate":"2023-03-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-2291","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2291","severity":null,"published_at":"2023-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-2291","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2291","severity":null,"published_at":"2017-08-09T18:29:00+00:00","modified_at":"2026-10-01T19:17:11+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}