CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
What It Is – A remote‑code‑execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) that can be triggered when an Office document (e.g., Word) invokes the msdt: URL protocol.
Exploitability – Actively exploited in the wild (the “Follina” attacks). Public proof‑of‑concepts exist; CVSS v3.1 base score 8.8 (High).
Affected Products – Microsoft Windows 10 / 11 and Windows Server editions that include MSDT; any Office application that can launch the protocol.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous application‑allow‑list monitoring and evidence that only approved protocols are enabled.
- Highlights gaps in patch‑management processes; timely remediation is a core control for audit readiness.
- Provides a concrete example of why logging of protocol‑handler calls and correlation with endpoint telemetry are essential for a defensible incident‑response trail.
Recommended Actions
- Deploy Microsoft’s security update that disables the vulnerable
msdt:protocol or applies the mitigation. - If immediate patching is not possible, block the
msdt:URL scheme via Group Policy or endpoint protection. - Verify that your application‑control solution logs any attempts to invoke MSDT and alerts on anomalous usage.
- Update your asset inventory to flag systems still running vulnerable Windows builds.
- Document the remediation steps as evidence for compliance audits.
Source: CISA KEV – CVE‑2022‑30190