CVE-2010-2568

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 91,3%

Kerentanan pada microsoft windows 7, microsoft windows server 2003 +3 lainnya. Skor CVSS 3.1 7.8 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 15 September 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Rincian

Terbit di NVD

22 Juli 2010

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

91,3% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Windows Remote Code Execution Vulnerability

Masuk KEV

15 September 2022

Tenggat CISA

6 Oktober 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://secunia.com/advisories/40647 advisory vendor
• http://www.microsoft.com/technet/security/advisory/2286198.mspx broken link · patch · advisory vendor
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046 patch · advisory vendor
• http://www.kb.cert.org/vuls/id/940193 patch · advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/cas/techalerts/TA10-222A.html advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2568 pemerintah AS
• http://securitytracker.com/id?1024216 broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/41732 broken link · exploit · advisory pihak ketiga · vdb entry
• https://www.geoffchappell.com/notes/security/stuxnet/ctrlfldr.htm advisory pihak ketiga
• http://isc.sans.edu/diary.html?storyid=9181 exploit · issue tracking
• http://www.f-secure.com/weblog/archives/new_rootkit_en.pdf exploit
• http://isc.sans.edu/diary.html?storyid=9190 issue tracking
• http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/ press/media coverage
• http://www.f-secure.com/weblog/archives/00001986.html not applicable
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11564 broken link