PT-2023-6942 · Microsoft · Windows

Will Metcalf · Published 2023-11-14 · Updated 2026-04-10 · CVE-2023-36025

Positive Technologies (AI Summary)

CVSS v2.0

10

High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions (affected versions not specified)

Description The vulnerability relates to a security feature bypass in the Windows SmartScreen component, allowing attackers to circumvent security checks and warnings. Exploitation involves tricking users into clicking specially crafted URLs or shortcut (.URL) files that link to attacker-controlled resources. Multiple threat actors have been observed actively exploiting this vulnerability, including campaigns distributing Phemedrone Stealer, Mispadu Stealer, BattleRoyale, and Lumma malware. The vulnerability has been used in phishing attacks and to deliver malicious payloads. The exploitation of this vulnerability has been observed globally, with a significant increase in the use of .URL files in Q4 2023. The vulnerability is tracked as CVE-2023-36025 and has a CVSS score of 8.8.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2023-07961

CVE-2023-36025

Affected Products

Windows

References · 205

• 🔥 https://github.com/ka7ana/CVE-2023-36025 · Exploit
• 🔥 https://github.com/J466Y/test_CVE-2023-36025 · Exploit
• 🔥 https://github.com/coolman6942o/-EXPLOIT-CVE-2023-36025 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36025 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36025 · Security Note
• https://bdu.fstec.ru/vul/2023-07961 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36025 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36025 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/701078 · Security Note
• https://twitter.com/fletch_ai/status/1734409497861353836 · Twitter Post
• https://twitter.com/mobilesmsio/status/1745826471166230920 · Twitter Post
• https://twitter.com/gothburz/status/1746990270825071037 · Twitter Post
• https://twitter.com/SecuriTricks/status/1747966367746097638 · Twitter Post