CVE-2010-3140

Microsoft Windows Internet Communication Settings - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-3140. PoCs published by ALPdaemon.

AI-analyzed exploit summary This exploit leverages DLL hijacking in Windows Internet Communication Settings by placing a malicious schannel.dll in the same directory as an .isp file. When the .isp file is opened, the malicious DLL executes arbitrary code (calc.exe in this case).

Description

Untrusted search path vulnerability in Microsoft Windows Internet Communication Settings on Windows XP SP3 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse schannel.dll that is located in the same folder as an ISP file.

Exploits (1)

exploitdb WORKING POC VERIFIED
by ALPdaemon · clocalwindows
https://www.exploit-db.com/exploits/14780

This exploit leverages DLL hijacking in Windows Internet Communication Settings by placing a malicious schannel.dll in the same directory as an .isp file. When the .isp file is opened, the malicious DLL executes arbitrary code (calc.exe in this case).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Windows XP SP3 (Internet Communication Settings)
No auth needed
Prerequisites: Victim must open a malicious .isp file placed in a directory where the attacker can control the DLL load path
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6743
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/14780

Scores

EPSS 0.1507
EPSS Percentile 96.3%

Details

Status published
Products (1)
microsoft/windows_xp
Published Aug 27, 2010
Tracked Since Feb 18, 2026