Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
AnalysisAI
Remote code execution in Windows Shell across XP through Windows 7 via malicious .LNK or .PIF shortcut files automatically processed when displayed in Windows Explorer. Confirmed actively exploited (CISA KEV) in 2010 Stuxnet campaign targeting Siemens WinCC SCADA systems, with 92.13% EPSS score reflecting historical widespread exploitation. Public exploits available. Originally weaponized as zero-day before Microsoft MS10-046 patch release.
Technical ContextAI
Windows Shell is the Windows Explorer graphical interface component responsible for rendering desktop elements, file browsing, and shortcut file handling. This vulnerability exists in the icon display handler for .LNK (Windows shortcut) and .PIF (Program Information File) files. When Windows Explorer renders these files, the shell improperly parses specially crafted shortcut metadata, allowing embedded code execution without opening the file. Affects all Windows versions from XP SP3 through Windows 7 and Server 2008 R2 across x86, x64, and Itanium architectures (per CPE data: windows_xp sp3, windows_vista sp1/sp2, windows_7, windows_server_2003 sp2, windows_server_2008 sp2/R2). The vulnerability was leveraged in conjunction with CVE-2010-2772 (Siemens WinCC default credentials) in the Stuxnet worm, marking one of the first major SCADA-targeting malware campaigns.
RemediationAI
Apply Microsoft Security Bulletin MS10-046 released August 2010, which patches the Windows Shell .LNK and .PIF parsing vulnerability across all affected Windows versions (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046). For systems that cannot immediately patch, Microsoft advisory 2286198 provides registry-based workaround to disable display of shortcut icons, though this degrades user experience and does not eliminate risk if users open malicious shortcuts directly. Disable AutoRun/AutoPlay features for removable media and network shares to prevent automatic code execution when directories containing weaponized .LNK files are browsed, though this does not prevent exploitation if user manually browses to directories. Restrict WEBDAV Client service and disable icon display for remote shares. Block .LNK and .PIF files at email gateways and web proxies. For industrial control systems and air-gapped networks, implement strict USB device controls and media scanning before introduction to secured environments. These compensating controls reduce attack surface but cannot substitute for patching, as Windows Explorer icon rendering occurs during normal file browsing operations. Legacy systems unable to receive MS10-046 require isolation or decommissioning.
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x
Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via craf
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages r
Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device
Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed
Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3
Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WI
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3
core/getLog.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) befor
The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devic
Share
External POC / Exploit Code
Leaving vuln.today