CVE-2022-30190
Published: June 14, 2022
Official Description
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
CISA KEV Advisory
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Apply updates per vendor instructions.
Risk Analysis
A remote code execution vulnerability exists when MSDT is called using the URL protocol from applications like Word. An attacker can run code with the privileges of the calling application, posing a significant risk. Its high EPSS score of 0.93461 and inclusion in CISA's KEV indicate a high likelihood of exploitation.
This vulnerability is actively exploited in the wild. The exploitation vector via URL protocol from common applications like Word makes it easily remotely exploitable.
Administrators should apply the latest security updates for Microsoft products to address this MSDT vulnerability. Users should be wary of opening suspicious documents or clicking on untrusted links that might invoke MSDT.
Technical Analysis
CVE-2022-30190 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2022-30190 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-30190 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1