Actively exploited in the wild
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2022-06-14. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-30190
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Risk Assessment
An attacker can execute code on the victim's machine, potentially leading to data theft, malware installation, or account takeover.
Recommendation
Apply Microsoft patches and consider disabling the MSDT protocol if not required.
Original NVD description (English source)
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.