What is the CVSS score of CVE-2010-2568?

CVE-2010-2568 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 92.1%.

Is there a public PoC exploit available for CVE-2010-2568?

Yes, a public proof-of-concept exploit is available for CVE-2010-2568. Prioritise patching immediately. EPSS: 92.1%.

How to fix or mitigate CVE-2010-2568?

Within 24 hours: Identify all Windows XP, Vista, and Windows 7 systems in your environment using network scanning tools and prioritize those with SCADA/ICS connections or handling external files. Within 7 days: Apply Microsoft MS10-046 security update to all affected systems; for Windows XP apply KB2286198, for Windows Vista/7 apply KB2219637 or later cumulative updates. Within 30 days: Disable or remove Windows shortcut file processing where operationally feasible, implement application whitelisting to block untrusted .LNK/.PIF execution, and complete transition planning for Windows XP/Vista systems to Windows 10 or later with full patching.

Windows Shell CVE-2010-2568

HIGH

2010-07-22 secure@microsoft.com

RCE Microsoft Siemens

7.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Position malicious .LNK file on target system
Delivery

Victim browses directory in Windows Explorer
Exploit

Shell parses crafted shortcut icon metadata
Execution

Trigger buffer handling flaw
Persist

Execute arbitrary code at victim privilege level
Impact

Establish persistence or lateral movement

Vulnerability Assessment

Exploitation Conditions	Requires victim to browse (view) a directory containing the malicious .LNK or .PIF file using Windows Explorer. No file opening or execution required - vulnerability triggers during automatic icon rendering when directory is displayed. Attack succeeds against default Windows configurations with standard icon preview enabled. Can be delivered remotely via network shares (SMB/WebDAV), removable media (USB drives), or email attachments that extract to local filesystem. User interaction required (UI:R in CVSS) but limited to normal file browsing behavior rather than explicit file execution. Local attack vector (AV:L) reflects execution context, though practical delivery often originates remotely via USB or network shares as demonstrated in Stuxnet campaign. No special privileges (PR:N) or non-default configurations required, affecting out-of-box Windows installations.
Impact	Critical real-world risk confirmed by multiple converging signals. CISA KEV listing confirms active exploitation in the wild during 2010. EPSS score of 92.13% (100th percentile) reflects historical widespread exploitation, though this represents 2010 attack patterns rather than current threat landscape. CVSS 7.8 with AV:L/UI:R suggests local attack vector requiring user interaction, but the Stuxnet campaign demonstrated practical remote exploitation via USB drives and network shares containing weaponized .LNK files that auto-execute when directories are viewed. Attack complexity is low (AC:L) with no privileges required (PR:N), making exploitation straightforward once malicious file is positioned. SSVC factors indicate confirmed exploitation (KEV), automatable delivery via removable media/shares, and high technical impact (arbitrary code execution). While Microsoft patched in August 2010 (MS10-046), legacy systems and air-gapped networks may remain vulnerable. Current prioritization should consider organizational exposure: critical for industrial control systems, legacy Windows environments, or networks accepting external media; lower for fully patched modern Windows 10/11 deployments. The historical Stuxnet association means this CVE remains referenced in threat intelligence for infrastructure targeting.
Exploit ScenarioDerived	Attacker creates weaponized USB drive or network share containing malicious .LNK file with embedded shellcode in icon metadata. When victim navigates to the directory in Windows Explorer, the shell automatically attempts to render the shortcut icon, triggering vulnerability without user needing to open or click the file. Malicious code executes with victim's privileges, establishing persistence or pivoting to additional targets. Stuxnet campaign used this technique to spread across air-gapped industrial networks via infected contractor USB drives, eventually reaching Siemens WinCC systems.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 92.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Apr 22, 2026

Remote code execution in Windows Shell across XP through Windows 7 via malicious .LNK or .PIF shortcut files automatically processed when displayed in Windows Explorer. Confirmed actively exploited (CISA KEV) in 2010 Stuxnet campaign targeting Siemens WinCC SCADA systems, with 92.13% EPSS score reflecting historical widespread exploitation. Public exploits available. Originally weaponized as zero-day before Microsoft MS10-046 patch release.

Earlier versions of this analysis (1)

v1 Mar 26, 2026 - 11:17 CVSS 7.8

A critical vulnerability in Windows Shell's handling of .LNK and .PIF shortcut files allows automatic code execution when Windows Explorer attempts to display the file's icon, without requiring the user to open the shortcut. This was the primary propagation vector for the Stuxnet worm.

RemediationAI

Apply Microsoft Security Bulletin MS10-046 released August 2010, which patches the Windows Shell .LNK and .PIF parsing vulnerability across all affected Windows versions (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046). For systems that cannot immediately patch, Microsoft advisory 2286198 provides registry-based workaround to disable display of shortcut icons, though this degrades user experience and does not eliminate risk if users open malicious shortcuts directly. Disable AutoRun/AutoPlay features for removable media and network shares to prevent automatic code execution when directories containing weaponized .LNK files are browsed, though this does not prevent exploitation if user manually browses to directories. Restrict WEBDAV Client service and disable icon display for remote shares. Block .LNK and .PIF files at email gateways and web proxies. For industrial control systems and air-gapped networks, implement strict USB device controls and media scanning before introduction to secured environments. These compensating controls reduce attack surface but cannot substitute for patching, as Windows Explorer icon rendering occurs during normal file browsing operations. Legacy systems unable to receive MS10-046 require isolation or decommissioning.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Windows Shell is the Windows Explorer graphical interface component responsible for rendering desktop elements, file browsing, and shortcut file handling. This vulnerability exists in the icon display handler for .LNK (Windows shortcut) and .PIF (Program Information File) files. When Windows Explorer renders these files, the shell improperly parses specially crafted shortcut metadata, allowing embedded code execution without opening the file. Affects all Windows versions from XP SP3 through Windows 7 and Server 2008 R2 across x86, x64, and Itanium architectures (per CPE data: windows_xp sp3, windows_vista sp1/sp2, windows_7, windows_server_2003 sp2, windows_server_2008 sp2/R2). The vulnerability was leveraged in conjunction with CVE-2010-2772 (Siemens WinCC default credentials) in the Stuxnet worm, marking one of the first major SCADA-targeting malware campaigns.

Know when Siemens gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Oct 22, 2025 - 01:15 cisa

CISA KEV

PoC Detected

Oct 22, 2025 - 01:15 vuln.today

Public exploit code

Patch released

Oct 22, 2025 - 01:15 nvd

Patch available

CVE Published

Jul 22, 2010 - 05:43 nvd

HIGH 7.8

DescriptionCVE.org

Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.

Executive ViewAI

Why It Matters

CVE-2010-2568 is a critical remote code execution vulnerability in Windows Shell that allows attackers to execute arbitrary code through malicious shortcut files (.LNK/.PIF) opened in Windows Explorer, confirmed actively exploited in the 2010 Stuxnet campaign targeting industrial control systems. Organizations still running unpatched Windows XP through Windows 7 systems face immediate risk of complete system compromise and lateral movement within critical infrastructure environments. This vulnerability has 92.1% exploitation probability and requires urgent patching across all affected legacy Windows deployments.

Business Impact: Severe

Compensating Controls

Apply vendor patch (Microsoft MS10-046: KB2286198 for XP, KB2219637 for Vista/7). Interim mitigations if patching delayed: block .LNK and .PIF file extensions at email gateways and network boundaries; disable AutoPlay/AutoRun features; restrict user permissions to prevent shortcut execution; implement network segmentation isolating legacy systems from critical infrastructure and external networks; monitor for suspicious shortcut file creation in user directories.

Threat Intelligence Overview

Threat Score

9.3/10

Composite threat intelligence

EPSS Score

92.1%

Top 0% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (3) THREAT

Exploit-DB

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 92.1%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Small

Automatable· derived

Human Impact

Very High

Priority Score

226

Low Medium High Critical

KEV: +50

EPSS: +92

CVSS: +39

PoC: +20

Weaponized: +15

Threat intel: +10

Gov advisory: 0

Attack Technique

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:-:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

More in Siemens

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-0144 HIGH Act Now POC

8.8 Mar 17

Remote code execution in Microsoft SMBv1 allows authenticated network attackers to execute arbitrary code on Windows sys

CVE-2017-0143 HIGH Act Now POC

8.8 Mar 17