Microsoft Patches 150 Flaws Including Two Zero

Microsoft Defender for IoT Remote Code Execution Vulnerability

CVE-2024-21412 is a security feature bypass (CWE-693) in how Microsoft Windows handles Internet Shortcut files: a crafted shortcut can make Windows skip the security warning prompt that normally appears before untrusted internet content is opened or downloaded. Triggering it requires user interaction — an attacker must deliver a malicious shortcut file, typically via email or a malicious website, and convince the user to open it, which is reflected in the CVSS vector's UI:R component. An attacker who succeeds gains a bypass of those prompts, making it easier to retrieve and execute malicious remote content with fewer warnings; the DarkGate malware operators used exactly this technique in zero-day campaigns to distribute their loader. Anyone running the affected Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), Windows Server 2019, or Windows Server 2022 (including 23H2) builds was exposed. The flaw was patched in Microsoft's February 2024 Patch Tuesday release (2024-02-13), the same day CISA added it to the KEV catalog, and it is under active exploitation with known ransomware association and a 95.4% EPSS score.

Do: Apply the February 2024 Windows cumulative security update (released 2024-02-13) or any later monthly cumulative update to every affected Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022 build, and verify patch levels through your endpoint inventory. Because exploitation requires user interaction, as an interim control flag or block .url/Internet Shortcut attachments at email gateways and remind users not to open shortcuts from untrusted sources. Prioritize internet-facing and shared endpoints given the KEV listing and known ransomware use.

Proxy Driver Spoofing Vulnerability

CVE-2024-29988 is a security feature bypass in Microsoft SmartScreen Prompt that allows an attacker to defeat the Mark of the Web (MotW) mechanism, which normally flags internet-downloaded files so SmartScreen shows a warning before they run. An attacker triggers it by delivering a crafted file that Windows processes without the expected SmartScreen prompt, often as part of an exploit chain with CVE-2023-38831 (WinRAR) or the related SmartScreen bypass CVE-2024-21412. Successful exploitation strips away a key browser/download defense layer, letting a malicious file execute with no user warning. Any Windows system that relies on SmartScreen to vet internet-delivered content is affected; the available data does not specify affected version ranges. The flaw is confirmed to be exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2024-04-30 — and EPSS estimates a 45.2% chance of exploitation in the next 30 days (99th percentile), though no public PoC is known.

Do: Apply Microsoft's update for CVE-2024-29988 as soon as possible via Windows Update, per CISA's KEV required action to apply vendor mitigations; verify patch status across Windows endpoints. Until patched, scrutinize internet-delivered archives and installers, and ensure the chain components are also remediated — update WinRAR for CVE-2023-38831 and patch the related SmartScreen bypass CVE-2024-21412.