CVE-2022-40964

What it actually does

Improper access control in Intel PROSet/Wireless WiFi and Killer WiFi software allows a locally authenticated privileged user to bypass restrictions and escalate privileges, potentially achieving full system-level access.

Why it matters to the business

Systems with affected Intel wireless drivers remain exposed to local attackers who already hold administrative rights, increasing the risk of full machine takeover, data exposure, and persistence on widely deployed laptops and desktops.

How an attack unfolds

An attacker with local high-privileged access interacts with the vulnerable WiFi driver components to leverage the missing access controls, resulting in execution of code or commands at a higher privilege level than intended.

How to fix it

Install the latest Intel PROSet/Wireless WiFi and Killer WiFi driver and software packages from Intel; apply any available firmware updates for the listed wireless adapters; replace end-of-life hardware where updates are unavailable.

How to confirm the fix worked

Compare installed Intel WiFi driver versions against current Intel security releases; inspect device manager or vendor management tools for update status; re-test privilege boundaries after patching.

Typical attack path

1. Gain local interactive access to a target endpoint
2. Obtain or use existing privileged (administrator) credentials
3. Interact with the Intel WiFi software to trigger the access-control flaw
4. Escalate to higher privileges such as SYSTEM or kernel context

How to detect it

Examine Windows event logs and driver logs for anomalous access or privilege changes involving Intel wireless components; look for unexpected child processes or registry modifications under the WiFi software paths after privileged logons.

What your security team should do

• Prioritize deployment of current Intel wireless drivers across all affected endpoints
• Limit the number of local administrator accounts and enforce least-privilege policies
• Include Intel WiFi components in regular vulnerability scanning and patch management
• Monitor vendor advisories for any future updates to the affected product families