CVE-2022-30190KEV · OVERDUE

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

High · published June 2, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1572
days past CISA
deadline
CVSS v3.1
7.8
EPSS
99%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A crafty URL can turn your Word document into a gateway for remote code execution! 💻 Think of it like a restaurant that lets in any delivery driver without checking their ID. If an attacker sends a specially crafted delivery notice (the URL), they could serve up malicious code right from your Word app! If exploited, an attacker could run arbitrary code with the same privileges as the calling application—meaning they can install programs, view, change, or even delete your data, or create new accounts. This high-severity vulnerability could lead to significant data loss or system compromise, and it’s already been exploited in the wild! 🔥

Put simply

Think of it like a restaurant that lets in any delivery driver without checking their ID. If an attacker sends a specially crafted delivery notice (the URL), they could serve up malicious code right from your Word app! This vulnerability occurs when the Microsoft Support Diagnostic Tool (MSDT) is invoked via a URL protocol from a calling application like Word, allowing remote code execution without proper authorization checks.

What to do

If exploited, an attacker could run arbitrary code with the same privileges as the calling application—meaning they can install programs, view, change, or even delete your data, or create new accounts. This high-severity vulnerability could lead to significant data loss or system compromise, and it’s already been exploited in the wild! 🔥 To protect your system, immediately disable the MSDT URL protocol by editing the registry, and ensure you're running the latest security updates from Microsoft. It's also wise to educate users on the risks associated with opening unexpected documents! 🛡️ You've got this! Follow these steps, and you'll lock down your systems like a pro! 🔒💪

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99163 · 99.9th percentile
Published
2022-06-02T00:15Z
KEV added
2022-06-14 · due 2022-07-05
Affected products (17)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1932510.0.10240.19325
microsoft/windows_10_1607< 10.0.14393.519210.0.14393.5192
microsoft/windows_10_1809< 10.0.17763.304610.0.17763.3046
microsoft/windows_10_20h2< 10.0.19042.176610.0.19042.1766
microsoft/windows_10_21h1< 10.0.19043.176610.0.19043.1766
microsoft/windows_10_21h2< 10.0.19044.176610.0.19044.1766
microsoft/windows_11_21h2< 10.0.22000.73910.0.22000.739
microsoft/windows_7all versions—
microsoft/windows_8.1all versions—
microsoft/windows_rt_8.1all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.519210.0.14393.5192
microsoft/windows_server_2019< 10.0.17763.304610.0.17763.3046
microsoft/windows_server_2022< 10.0.20348.77010.0.20348.770
microsoft/windows_server_20h2< 10.0.19042.176610.0.19042.1766
References (4)
EPSS history
Timeline
  • 14 JUN 00:00Z
    Added to CISA KEV — remediate by Jul 5
    kev
  • 01 JUN 20:10Z
    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
    cvelistv5