CVE-2021-41365: Microsoft Azure Defender for IoT maintenanceWindow Endpoint SQL Injection Privilege Escalation Vulnerability
Microsoft Defender for IoT Remote Code Execution Vulnerability
Other sources
This vulnerability allows remote attackers to escalate privileges on affected installations of Microsoft Azure Defender for IoT. Authentication is required to exploit this vulnerability. The specific flaw exists within the maintenanceWindow endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.
— ZDI
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41365?
CVE-2021-41365 is a vulnerability in Microsoft Azure Defender for IoT that allows remote attackers to escalate privileges on affected installations.
What is the severity of CVE-2021-41365?
The severity of CVE-2021-41365 is high with a score of 8.8.
How does CVE-2021-41365 impact Microsoft Azure Defender for IoT?
CVE-2021-41365 allows remote attackers to escalate privileges on affected installations of Microsoft Azure Defender for IoT.
Is authentication required to exploit CVE-2021-41365?
Yes, authentication is required to exploit CVE-2021-41365.
How can I mitigate CVE-2021-41365?
To mitigate CVE-2021-41365, update to the latest version of Microsoft Azure Defender for IoT as recommended by Microsoft.