Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server…
Priority CRITICAL 93Exploited in the wildPublished · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
Why it matters now
Exploitation Active In CISA KEV since 2022-09-15CISA due date 2022-10-06
EPSS 0.89623 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-09-15 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2010-2568
- 2026-10-03 Alias added: GHSA-6j7w-pxhr-g4pr
References
Exploit 2
More Microsoft Windows 7 vulnerabilities
- TI-2019-00485 Use after free in Microsoft Windows KEVCVSS 3.1CRITICAL 9.8
- TI-2017-06077 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-01465 HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-19649 Windows Scripting Languages Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2021-17496 Microsoft MSHTML Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2021-13480 Scripting Engine Memory Corruption Vulnerability KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2010-2568 · CVE Program
- CVE-2010-2568 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-6j7w-pxhr-g4pr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences