PT-2024-1646 · Microsoft · Defender Smartscreen+4

Dima Lenz + 4 · Published 2024-02-13 · Updated 2026-05-25 · CVE-2024-21412

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the February 2024 patch update are affected, including Windows 10 and Windows 11.

Description The vulnerability is related to Internet Shortcut Files and allows attackers to bypass Microsoft Defender SmartScreen, enabling them to execute arbitrary code on affected systems. This issue has been exploited by the Water Hydra APT group, targeting financial traders. The attackers use specially crafted files to bypass security warnings, leading to the installation of malware such as DarkMe. Phishing emails are a common threat vector used in these attacks.

Recommendations To resolve the issue, apply the February 2024 patch update or later to your Microsoft Windows system. Ensure that your Windows operating system is up-to-date to protect against this vulnerability. As a temporary workaround, consider restricting access to Internet Shortcut Files and avoiding the use of suspicious links or files from untrusted sources until the patch is applied.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-254

Related Identifiers

BDU:2024-01320

CVE-2024-21412

ZDI-24-165

Affected Products

Internet Shortcut Files

Defender Smartscreen

Windows

Windows 10

Windows 11

References · 391

• 🔥 https://github.com/lsr00ter/CVE-2024-21412_Water-Hydra · Exploit
• 🔥❌ https://github.com/esThreatIntelligence/ExploitedSite · Exploit, Deleted
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21412 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21412 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21412 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-165 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/704912 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21412 · Security Note
• https://twitter.com/thetechnodized/status/1768227847041388651 · Twitter Post
• https://twitter.com/nichii_a/status/1768967499675271509 · Twitter Post
• https://twitter.com/Komodosec/status/1823540194521571346 · Twitter Post
• https://twitter.com/TrendMicro/status/1759638985989628142 · Twitter Post