CVE-2025-30397
📋 TL;DR
A type confusion vulnerability in Microsoft Scripting Engine allows remote attackers to execute arbitrary code by sending specially crafted network requests. This affects systems running vulnerable versions of Microsoft software that use the scripting engine. Attackers can exploit this without authentication over a network connection.
💻 Affected Systems
- Microsoft Scripting Engine
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Remote code execution with attacker gaining the same privileges as the scripting engine process, typically leading to lateral movement and data exfiltration.
If Mitigated
Attack blocked at network perimeter or by application controls, with no successful exploitation despite attempts.
🎯 Exploit Status
CISA has added this to Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific patch versions
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397
Restart Required: Yes
Instructions:
1. Apply latest Microsoft security updates via Windows Update or WSUS. 2. Restart affected systems. 3. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to systems using Microsoft Scripting Engine
Scripting Engine Disablement
windowsDisable Microsoft Scripting Engine if not required
reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_SCRIPTING" /v "*" /t REG_DWORD /d 1 /f
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy application control solutions to block unauthorized script execution
🔍 How to Verify
Check if Vulnerable:
Check system against Microsoft Security Update Guide or run vulnerability scanner with CVE-2025-30397 detectionCheck Version:
wmic qfe list full | findstr /i "CVE-2025-30397"Verify Fix Applied:
Verify Windows Update history shows relevant security patch installed and system version matches patched version📡 Detection & Monitoring
Log Indicators:
- Unusual script execution events
- Process creation from scripting engine with suspicious parameters
- Network connections to scripting engine ports from unexpected sources
Network Indicators:
- Traffic patterns indicating exploitation attempts on scripting engine ports
- Anomalous network requests to scripting services
SIEM Query:
source="windows" AND (event_id=4688 OR event_id=4104) AND process_name="*script*" AND command_line="*suspicious*"🔗 References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397
- https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-detection-script
- https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-mitigation-script
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30397
