HowToFixMe
● High · CVSS 7.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2015-2291: Improper Input Validation in Ethernet Diagnostics Driver For Windows

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance
SeverityCVSS 7.8 - High (AV:L, local attacker)
Actively exploited?Yes, listed in CISA KEV (added 2023-02-10)
AffectedIntel Ethernet diagnostics driver IQVW32.sys and IQVW64.sys before 1.3.1.0 (Windows)
Fixed inIQVW32.sys / IQVW64.sys version 1.3.1.0 or later
Type (CWE)CWE-20 Improper Input Validation (kernel IOCTL)

Exploitation status

CVE-2015-2291 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability”, which makes remediation mandatory for U.S. federal agencies under Binding Operational Directive 22-01. The exploitation here is local: the IQVW64.sys driver is validly signed by Intel, so threat actors drop it onto a host they already control and abuse it as a bring-your-own-vulnerable-driver (BYOVD) primitive to escalate from a normal account to kernel privileges. If you run an affected system, treat this as a priority change.

Public exploit availability: a working public exploit is published on Exploit-DB (entry 36392), and the technique is folded into well-known BYOVD tooling. Assume the IOCTL exploit path is fully weaponized.

Authoritative references:

Remediate on priority. CISA's Known Exploited Vulnerabilities catalog lists this CVE (added 2023-02-10), which means active exploitation has been confirmed. The fix is to remove the old Intel driver, move to IQVW32.sys/IQVW64.sys 1.3.1.0 or later, and block the vulnerable build at the kernel level.

What is CVE-2015-2291?

CVE-2015-2291 is a kernel-level flaw in Intel's Ethernet diagnostics driver for Windows. Two driver files carry it: IQVW32.sys on 32-bit Windows and IQVW64.sys on 64-bit Windows, both before version 1.3.1.0. These ship inside the Intel Network Adapter Driver and PROSet package as the helper the diagnostics tool uses to poke at the network card directly.

The driver exposes a set of I/O control codes (IOCTLs) but does not validate the input that comes in through them. A local user can hand it a crafted call to 0x80862013, 0x8086200B, 0x8086200F, or 0x80862007 and either crash the box (denial of service) or run their own code with kernel privileges. That is the CWE-20 improper input validation pattern: trusted code accepts untrusted bytes and acts on them.

Read the CVSS vector carefully: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.8 (High). AV:L means local. There is nothing to reach over the network and nothing for a firewall or WAF to filter. The threat is a user or process that already has a foothold on the machine pivoting up to SYSTEM-or-higher kernel control.

Why this CVE matters

A vulnerability this old normally fades. This one did not, and the reason is the signature. IQVW64.sys is signed by Intel with a certificate Windows trusts, so the file loads even on a hardened machine. Attackers who land on a host with only normal-user rights bring their own copy of the vulnerable driver, load it, and use the IOCTL bug as a clean path into the kernel. That is the bring-your-own-vulnerable-driver (BYOVD) technique, and a signed-but-flawed driver like this one is exactly the kind of part it relies on.

Once code runs in the kernel, the usual endpoint controls are at the attacker's mercy: they can disable EDR callbacks, clear protections on processes, and read or tamper with anything in memory. CISA put the CVE on the Known Exploited Vulnerabilities catalog on 2023-02-10 because this abuse was being seen in the field. If a vulnerable copy of the driver can be loaded anywhere in your fleet, it is a live kernel-escalation primitive whether or not anyone ever ran Intel diagnostics on that machine.

Identify the vulnerable driver

The unit you care about is the driver file, not an installed application. Hunt for IQVW32.sys and IQVW64.sys on disk and read the file version. Anything below 1.3.1.0 is vulnerable.

# Run in an elevated PowerShell prompt.
# Find every copy of the Intel Ethernet diagnostics driver and read its version.
Get-ChildItem -Path C:\ -Recurse -Include IQVW32.sys,IQVW64.sys -ErrorAction SilentlyContinue |
    ForEach-Object {
        [PSCustomObject]@{
            Path    = $_.FullName
            Version = $_.VersionInfo.FileVersion
            Hash    = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        }
    } | Format-List

# Is the driver currently loaded into the running kernel?
driverquery /v /fo csv | Select-String "IQVW"
fltmc filters 2>$null   # cross-check loaded kernel modules

Compare any version you find against 1.3.1.0. If the file version reads 1.3.0.x or older, that copy is exploitable and needs to go.

How to fix CVE-2015-2291

There is a clean fixed version: Intel corrected the IOCTL handling in IQVW32.sys / IQVW64.sys 1.3.1.0. The fix has two parts. First, remove or update the vulnerable driver so the patched code is what loads. Second, block the old signed driver so it cannot be reloaded later as a BYOVD attack tool. This is not a Windows Update KB and there is no apt or yum package for it; it is a third-party Intel driver you manage directly.

Step 1: remove or update the Intel driver

# Run elevated. List Intel network / diagnostics driver packages in the driver store.
pnputil /enum-drivers | Select-String -Context 2 -Pattern "Intel"

# If the Intel network diagnostics utility is installed as a program, uninstall it,
# then download the current Intel Network Adapter Driver / PROSet package from intel.com
# and install it so IQVW32.sys / IQVW64.sys is at 1.3.1.0 or later.
Get-Package -Provider Programs | Where-Object { $_.Name -match 'Intel.*Network|PROSet|Ethernet' }

# To delete a specific stale OEM driver package from the driver store, use the
# oemNN.inf name reported by pnputil above:
# pnputil /delete-driver oemNN.inf /uninstall /force

If the machine does not actually need the Intel diagnostics tooling, the safest outcome is to remove the driver entirely rather than carry any version of it.

Step 2: block the vulnerable driver in the kernel

Removing the file is not enough on its own, because an attacker can supply their own copy. Enable Microsoft's vulnerable driver blocklist, which already covers known-bad signed drivers like this one, and back it with a Windows Defender Application Control (WDAC) deny rule keyed to the file hashes you collected in the identify step.

# Turn on the Microsoft vulnerable driver blocklist (Win10 1903+ / Win11 / Server 2019+).
# This is also exposed in Windows Security > Device security > Core isolation.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Memory integrity (HVCI) hardens the kernel against a loaded malicious driver.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
# A reboot is required for both settings to take effect.

For a managed fleet, push a WDAC policy that denies the specific IQVW32.sys / IQVW64.sys hashes below 1.3.1.0, and deploy it through Intune or Group Policy. That stops the BYOVD reload path across every endpoint, not just the one you cleaned by hand.

If you can't patch immediately

Updating and blocking the driver is the durable fix. While that change is scheduled, you can cut the risk:

Verify the fix

After updating and blocking, confirm two things: the patched version is what is on disk, and the old driver can no longer load.

# 1. Confirm any remaining IQVW driver is 1.3.1.0 or later.
Get-ChildItem -Path C:\ -Recurse -Include IQVW32.sys,IQVW64.sys -ErrorAction SilentlyContinue |
    ForEach-Object { "$($_.FullName)  ->  $($_.VersionInfo.FileVersion)" }

# 2. Confirm the vulnerable driver blocklist is enabled.
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" -Name VulnerableDriverBlocklistEnable

# 3. Confirm the old driver is not currently loaded.
driverquery /v /fo csv | Select-String "IQVW"

Finish with an authenticated vulnerability scan using a current signature set and confirm the scanner no longer flags CVE-2015-2291. Because exploitation of this driver gives kernel control, treat any host where a pre-1.3.1.0 copy was loadable as worth a closer look: review for unexpected drivers, disabled security tooling, and new local administrator accounts over the exposure window.

Frequently asked questions

What is the fixed version for CVE-2015-2291?

Intel fixed the flaw in version 1.3.1.0 of the IQVW32.sys and IQVW64.sys driver, shipped with the Intel Network Adapter Driver / PROSet diagnostic package. Any IQVW32.sys or IQVW64.sys older than 1.3.1.0 is vulnerable. Remove or update the driver to 1.3.1.0 or later.

Is CVE-2015-2291 a remote vulnerability?

No. The CVSS vector is AV:L, meaning the attacker must already have local access. A low-privileged local user sends a crafted IOCTL (0x80862013, 0x8086200B, 0x8086200F, or 0x80862007) to the driver to crash the machine or run code with kernel privileges. There is no network exposure to firewall.

Why is this driver abused even on machines that never used Intel diagnostics?

IQVW64.sys is a validly signed Intel driver, so attackers drop it themselves and exploit it as a bring-your-own-vulnerable-driver (BYOVD) kernel primitive. The fix is to block the vulnerable IQVW32.sys/IQVW64.sys hashes with the Microsoft vulnerable driver blocklist or a WDAC policy, not just to uninstall the Intel utility.

References

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related weaknesses in the same component worth addressing at the same time:

People also ask

What is the fixed version for CVE-2015-2291?

Intel fixed the flaw in version 1.3.1.0 of the IQVW32.sys and IQVW64.sys driver, shipped with the Intel Network Adapter Driver / PROSet diagnostic package. Any IQVW32.sys or IQVW64.sys older than 1.3.1.0 is vulnerable. Remove or update the driver to 1.3.1.0 or later.

Is CVE-2015-2291 a remote vulnerability?

No. The CVSS vector is AV:L, meaning the attacker must already have local access. A low-privileged local user sends a crafted IOCTL (0x80862013, 0x8086200B, 0x8086200F, or 0x80862007) to the driver to crash the machine or run code with kernel privileges. There is no network exposure to firewall.

Why is this driver abused even on machines that never used Intel diagnostics?

IQVW64.sys is a validly signed Intel driver, so attackers drop it themselves and exploit it as a bring-your-own-vulnerable-driver (BYOVD) kernel primitive. The fix is to block the vulnerable IQVW32.sys/IQVW64.sys hashes with the Microsoft vulnerable driver blocklist or a WDAC policy, not just to uninstall the Intel utility.