Back to KEVs

CVE-2018-8174

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote...

Basic Information

CVE State: PUBLISHED
Reserved Date: March 14, 2018
Published Date: May 09, 2018
Last Updated: February 07, 2025
Vendor: Microsoft
Product: Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

CVSS Scores

CVSS v3.1

7.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

7.6 -

Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

SSVC Information

Exploitation: active
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2022-02-15 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2020-07-31 03:13:43 UTC) Source
Used in Malware: Yes (added 2022-02-15 00:00:00 UTC) Source

References

https://www.exploit-db.com/exploits/44741/ https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174 http://www.securityfocus.com/bid/103998

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-02-15 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

lisinan988/CVE-2018-8174-exp

Type: github • Created: 2021-11-25 05:06:25 UTC • Stars: 0

ericisnotrealname/CVE-2018-8174_EXP

Type: github • Created: 2020-07-31 03:13:43 UTC • Stars: 0

likekabin/CVE-2018-8174-msf

Type: github • Created: 2018-09-06 04:03:25 UTC • Stars: 0

orf53975/Rig-Exploit-for-CVE-2018-8174

Type: github • Created: 2018-06-26 09:03:45 UTC • Stars: 1

Rig Exploit for CVE-2018-8174 As with its previous campaigns, Rig’s Seamless campaign uses malvertising. In this case, the malvertisements have a hidden iframe that redirects victims to Rig’s landing page, which includes an exploit for CVE-2018-8174 and shellcode. This enables remote code execution of the shellcode obfuscated in the landing page. After successful exploitation, a second-stage downloader is retrieved, which appears to be a variant of SmokeLoader due to the URL. It would then download the final payload, a Monero miner.