PT-2024-6671 · Microsoft · Windows+2

Andres + 1 · Published 2024-10-08 · Updated 2025-06-10 · CVE-2024-43572

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to 10.0.10240.20796 Microsoft Windows versions prior to 10.0.14393.7428 Microsoft Windows versions prior to 10.0.17763.6414 Microsoft Windows versions prior to 10.0.19044.5011 Microsoft Windows versions prior to 10.0.19045.5011

Description: The issue is related to a remote code execution problem in Microsoft Management Console. It allows attackers to execute arbitrary code on targeted Windows systems by rigging Microsoft Saved Console (MSC) files. The vulnerability can be exploited when a user loads a specially crafted MSC file. There have been reports of active exploitation of this issue.

Recommendations: For Microsoft Windows versions prior to 10.0.10240.20796, update to a version that includes the security patch. For Microsoft Windows versions prior to 10.0.14393.7428, update to a version that includes the security patch. For Microsoft Windows versions prior to 10.0.17763.6414, update to a version that includes the security patch. For Microsoft Windows versions prior to 10.0.19044.5011, update to a version that includes the security patch. For Microsoft Windows versions prior to 10.0.19045.5011, update to a version that includes the security patch. As a temporary workaround, consider restricting access to untrusted Microsoft Saved Console (MSC) files until a patch is available.

Fix

RCE

Improper Neutralization

Weakness Enumeration

CWE-707

Related Identifiers

BDU:2024-07877

CVE-2024-43572

Affected Products

Management Console

Saved Console

Windows

References · 87

• https://bdu.fstec.ru/vul/2024-07877 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/712721 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43572 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43572 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43572 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43572 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/advisory/CVE-2024-43572 · Vendor Advisory
• https://github.com/EmergingThreats/threatresearch · Note
• https://twitter.com/BertJanCyber/status/1843718769065243079 · Twitter Post
• https://t.me/aptreports/14284 · Telegram Post
• https://twitter.com/thecyberwall/status/1843828404443066756 · Twitter Post
• https://t.me/zerodayalert/351 · Telegram Post
• https://twitter.com/CISACyber/status/1843728938331169234 · Twitter Post
• https://twitter.com/buaqbot/status/1843776054344712510 · Twitter Post