⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-07-05.
CVE-2022-30190
Severity
7.8HIGH
EPSS
93.6%
top 0.17%
CISA KEV
KEVRansomware
Added 2022-06-14
Due 2022-07-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJun 1
KEV addedJun 14
KEV dueJul 5
Latest updateJan 27
CISA Required Action: Apply updates per vendor instructions.
Description
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Please see the MSRC Blog Entry for important information about steps you can take to protect your system …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages30 packages
▶CVEListV5microsoft/windows_server_2008_r2_service_pack_1_(server_core_installation)6.1.7601.0 — 6.1.7601.25984
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-4r9q-wqcj-x85j: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability↗2022-06-02
CVEList
▶
🔍Detection Rules
9📋Vendor Advisories
2🕵️Threat Intelligence
18Fortinet
▶