Log in Start free

Actively exploited · Published Jul 22, 2010 · Assigned by microsoft

CVE-2010-2568

High 7.8 Exploited

In plain English

A high-severity security flaw in Windows from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on September 15, 2022). The chance it is exploited in the next 30 days is estimated at 89.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)89.6%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Sep 15, 2022
Attack tooling1Metasploit

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Oct 6, 2022.

Official description

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References