Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 91.3%; technical severity is CVSS 7.8.
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
Who should care
- Teams operating Windows, Windows 7, Windows Server 2003 +3 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Windows, Windows 7, Windows Server 2003 +3 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Microsoft Security patch 2286198.mspx
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Patch
Technical details
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CWE
- CWE-20
- Affected versions
- Microsoft Windows; Microsoft Windows 7 (Version -); Microsoft Windows Server 2003 (Version -); Microsoft Windows Server 2008 (Version - | Version - | Version r2 | Version r2); Microsoft Windows Vista (Version - | Version -); Microsoft Windows Xp (Version - | Version -)
- Fixed versions
- No explicit fixed version is currently recorded.
- Published
- 22 July 2010
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 91.3%
- Signal calculated at 82
External references
- CISA Government advisory CVE-2010-2568
- Exploit information from isc.sans.edu
- Isc Sans Edu Technical reference
- Krebsonsecurity Technical reference Experts Warn Of New Windows Shortcut Flaw
- Secunia Technical reference
- Securitytracker Third-party advisory
- F Secure Technical reference 00001986
- Exploit information from www.f-secure.com
- Exploit information from www.securityfocus.com
- Us Cert Government advisory TA10 222A
- Oval Cisecurity Technical reference Oval%3Aorg.mitre.oval%3Adef%3A11564
- Geoffchappell Third-party advisory Ctrlfldr