Cyber Advisors Security Updates June 2022
Rob 06/21/2022
2 Minutes

The June 2022 Microsoft Patch Tuesday consists of 55 vulnerabilities with (3) classified as 'Critical' and the rest marked as 'Important'. Breakout of types are below:


  • 27 Remote Code Execution (RCE) Vulnerabilities
  • 12 Elevation of Privilege Vulnerabilities
  • 1 Security Feature Bypass Vulnerability
  • 11 Information Disclosure Vulnerabilities
  • 3 Denial of Service Vulnerabilities
  • 1 Spoofing Vulnerability


The 'Critical' rated vulnerabilities affect Windows Hyper-V (RCE), Windows Lightweight Directory Access Protocol (LDAP) (RCE), and the Windows Network File Systems (NFS) (RCE). Updates can be found here:



The Microsoft Diagnostic Tool (MSDT) Attack Vector:


The "Follina" zero-day (CVE-2022-30190) is fixed in this month's security fixes from Microsoft. This was initially discovered two weeks before the monthly updates. The zero-day derived from attacks leveraging the Windows Microsoft Diagnostic Tool (MSDT) which bypasses security controls and executes PowerShell scripts by just opening a Word document (to include MS Office Protected View).


"DogWalk" is another zero-day security flaw leveraging the MSDT. DogWalk is a path traversal and allows a threat actor to copy an executable via Windows Startup Folder and bypasses the "Mark of the Web" (MOTW) security feature. The malicious file (.diagcab) would be executed automatically upon a restart on the device. Microsoft initially stated both Follina and DogWalk were not "security-related issues", however, security researchers provided proof of concepts exploiting the attack vector. Unofficial patches were released by third parties to cover the gap while Microsoft worked on a fix.


Cumulative updates for versions 21H2, version 21H1, and 1809 have KBs (KB5014699 and KB5014692) released to resolve security issues and bugs. This update is mandatory and will be installed by Windows Update during one's service window.


Be aware that the June Windows Server updates may cause backup issues using Volume Shadow Copy Service (VSS) due to Microsoft attempting to address an elevation of privilege vulnerability (CVE-2022-30154) which itself is currently rated as a ‘Medium’ severity. A suggested resolution is to install Windows updates released on June 14th and later for both the File Server and Application Server. Refer to Bleeping Computer's article for further information.


Other notable vulnerabilities and security issues discovered over the month include:


  • Atlassian Confluence - Remote Code Execution (CVE-2022-26134)
  • Zyxel - Remote Code Execution (CVE-2022-30525)
    • Zyxel released security updates impacting affected models, however, admins must request a hotfix for the AP controllers as the fix is not publicly available
  • VMware - VMware Workspace ONE, Identify Manager (vIDM), vRealize Automation (vRA), Cloud Foundation, and vRealize Suite Lifecycle Manager are affected products
  • Cisco released a patch for the IOS XR zero-day vulnerability (CVE-2022-20821) which could be abused by unauthenticated remote threat actors




Related Posts

It is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout.

Kate Drankoff 23 December, 2021

December Microsoft Zero-Day and Patch Tuesday

Let's Chat About Microsoft Zero-Day and Patch Tuesday With Microsoft zero-day under attack and a…