Threat Advisory: Zero-day vulnerability in Microsoft diagnostic tool MSDT could lead to code execution
Summary: A zero-day vulnerability in the Microsoft Windows Support Diagnostic Tool, tracked as CVE-2022-30190 and named "Follina," exists when MSDT is called using the URL protocol from an application such as Microsoft Office or Word, or via an RTF file, and lets an attacker run arbitrary code on the targeted system. No patch had been released at the time of the advisory; Microsoft provided workarounds and Windows Defender protections, and Cisco Talos reported ongoing exploitation in the wild and released Snort and ClamAV coverage.
Why it matters: Exploitation was already happening in the wild before a patch existed, leaving the workaround - disabling the MSDT URL protocol - as the main defense, and Talos urged users to test and implement it as quickly as possible.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-30190
- Related
- Researchers Uncover GPT-4-Powered Mal Terminal Malware Creating Ransomware, Reverse Shell Cyber Risks ·2022 0-day In-the-Wild Exploitation…so far Cyber Risks ·CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 14, 2022