PT-2022-5391 · Microsoft · Windows

Benoît Sevens + 1 · Published 2022-11-08 · Updated 2025-12-10 · CVE-2022-41128

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to 10.0.10240.19567 Microsoft Windows 10 1507 versions prior to 10.0.10240.19567 Microsoft Windows 10 1607 versions prior to 10.0.14393.5501 Microsoft Windows 10 1809 versions prior to 10.0.17763.3650 Microsoft Windows 10 20h2 versions prior to 10.0.19042.2251 Microsoft Windows 10 21h1 versions prior to 10.0.19043.2251

Description The issue is related to a remote code execution vulnerability in the Windows Scripting Languages. It allows remote attackers to execute arbitrary code and affect the system. The vulnerability was exploited by North Korean hackers, known as APT37, in targeted attacks on South Korean neighbors. The attack was implemented by embedding malicious software in documents referencing a recent mass incident in Itaewon, Seoul. The vulnerability was used to deliver malicious software or execute arbitrary code when displaying a website controlled by an attacker. The estimated number of potentially affected devices is not specified.

Recommendations For Microsoft Windows versions prior to 10.0.10240.19567, update to a version newer than 10.0.10240.19567. For Microsoft Windows 10 1507 versions prior to 10.0.10240.19567, update to a version newer than 10.0.10240.19567. For Microsoft Windows 10 1607 versions prior to 10.0.14393.5501, update to a version newer than 10.0.14393.5501. For Microsoft Windows 10 1809 versions prior to 10.0.17763.3650, update to a version newer than 10.0.17763.3650. For Microsoft Windows 10 20h2 versions prior to 10.0.19042.2251, update to a version newer than 10.0.19042.2251. For Microsoft Windows 10 21h1 versions prior to 10.0.19043.2251, update to a version newer than 10.0.19043.2251.

Fix

RCE

Memory Corruption

Code Injection

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-94

CWE-119

Related Identifiers

BDU:2022-06705

CVE-2022-41128

Affected Products

Windows

References · 37

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41128 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41128 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41128 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-41128 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06705 · Security Note
• https://github.com/0x0v1/MalwareRETools · Note
• https://t.me/aptreports/18590 · Telegram Post
• https://t.me/cvenotify/45388 · Telegram Post
• https://twitter.com/DredgeDiver/status/1989106408751800323 · Twitter Post
• https://t.me/cybersecuritytechnologies/7324 · Telegram Post
• https://t.me/aptreports/24425 · Telegram Post
• https://t.me/aptreports/16090 · Telegram Post
• https://t.me/aptreports/13869 · Telegram Post