{"id":"CVE-2010-1885","published":"2010-06-14T18:00:00Z","modified":"2024-08-07T01:35:53Z","title":"The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka \"Help Center URL Validation Vulnerability.\"","provenance":"source","from":"CVE.org"},"summary":{"text":"A vulnerability in Microsoft Windows Help and Support Center on Windows XP and Windows Server 2003 allows remote attackers to bypass the trusted documents whitelist and execute arbitrary commands via a crafted hcp:// URL. Windows XP and Windows Server 2003 users are affected.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:12Z"},"cvss":null,"epss":{"score":0.71148,"percentile":0.99405,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2011-07-26","exploitedFirstSeen":"2011-07-26","ransomware":false,"evidence":[{"url":"https://www.hkcert.org/blog/large-scale-injection-incidents-targeting-oscommerce-websites","date":"2011-07-26"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/wham-bam-the-cutwailblackhole-combo/","date":"2012-07-02"},{"url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf","date":"2016-02-23"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"2016: Malware Analysis Report","url":"https://otx.alienvault.com/pulse/69f4eba31a8adb1aa8e6654d","created":"2026-05-01"},{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"VirusTotal report\n                    for Bang Bang#2.xls","url":"https://otx.alienvault.com/pulse/69b4e2ca96bf79781b0ae3bd","created":"2026-03-14"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"CVE -CVE Reference Map for Source MS - Curios RE active candidates CVE version 20061101","url":"https://otx.alienvault.com/pulse/679c3446de4f362fac9217f9","created":"2025-01-31"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.kb.cert.org/vuls/id/578319","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://www.securityfocus.com/archive/1/511774/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/59267","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.securityfocus.com/archive/1/511783/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://blogs.technet.com/b/srd/archive/2010/06/10/help-and-support-center-vulnerability-full-disclosure-posting.aspx","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/40725","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0197.html","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://www.securitytracker.com/id?1024084","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.exploit-db.com/exploits/13808","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://blogs.technet.com/b/msrc/archive/2010/06/10/windows-help-vulnerability-disclosure.aspx","tags":["x_refsource_MISC"]},{"url":"http://www.microsoft.com/technet/security/advisory/2219475.mspx","tags":["x_refsource_CONFIRM"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-194A.html","tags":["third-party-advisory","x_refsource_CERT"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11733","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.vupen.com/english/advisories/2010/1417","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-042","tags":["vendor-advisory","x_refsource_MS"]},{"url":"http://secunia.com/advisories/40076","tags":["third-party-advisory","x_refsource_SECUNIA"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-bd66404e0d19e11c07fa","title":"Operation Dust Storm","publisher":"s7d2.scene7.com","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf","date":null,"mentions":[{"quote":"malicious Windows Help (.hlp) file, which exploited CVE-\r\n2010-1885.","start":5753,"end":5821}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-1904","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-1904","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":13808,"url":"https://www.exploit-db.com/exploits/13808","title":"Microsoft Windows Help Centre Handles - Malformed Escape Sequences Incorrectly (MS03-044)","type":"remote","platform":"windows","date":"2010-06-10","verified":true,"provenance":"source"},{"id":16545,"url":"https://www.exploit-db.com/exploits/16545","title":"Microsoft Help Center - Cross-Site Scripting / Command Execution (MS10-042) (Metasploit)","type":"remote","platform":"windows","date":"2010-09-20","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2010-06-10"},"metasploit":[{"name":"Microsoft Help Center XSS and Command Execution","module":"exploit/windows/browser/ms10_042_helpctr_xss_cmd_exec","type":"exploit","disclosureDate":"2010-06-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb"}],"first":{"date":"2010-06-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb"},"provenance":"source"},"exploitRefs":["http://www.exploit-db.com/exploits/13808"],"flow":[{"stage":"related","techniques":["T1189","T1203","T1204.002"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2010-06-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2010-06-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb","provenance":"source"},{"date":"2010-06-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2010-1885","provenance":"source"},{"date":"2011-07-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.hkcert.org/blog/large-scale-injection-incidents-targeting-oscommerce-websites","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":65.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5574 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}