10
CVSSv2

CVE-2021-42311

Published: 15/12/2021 Updated: 28/12/2023
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9
VMScore: 890
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

This vulnerability allows remote malicious users to bypass authentication on affected installations of Microsoft Azure Defender for IoT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the update-handshake endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to bypass authentication on the system and execute arbitrary code in the context of root.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft defender for iot

Recent Articles

Detailed: Critical hijacking bugs that took months to patch in Microsoft Azure Defender for IoT
The Register • Jessica Lyons Hardcastle • 01 Jan 1970

Get our weekly newsletter SQL injection, race condition, bad cryptographic check pave way for infrastructure network takeovers

SentinelOne this week detailed a handful of bugs, including two critical remote code execution vulnerabilities, it found in Microsoft Azure Defender for IoT. These security flaws, which took six months to address, could have been exploited by an unauthenticated attacker to compromise devices and take over critical infrastructure networks. Microsoft Azure Defender for IoT is supposed to detect and respond to suspicious behavior as well as highlight known vulnerabilities, and manage patching and e...