CVE-2024-21322CriticalCVSS 7.2
Microsoft Defender for IoT Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires the attacker to be an administrator of the web application. As is best practice, regular validation and audits of administrative groups should be conducted.
What actions do customers need to take to protect themselves from this vulnerability? Customers need to update their Defender for IoT software to version 24.1.3 or above. For more information, see OT monitoring software versions.
🎯 Affected products1
- Microsoft Defender for IoT
✅ Remediation
KBRelease Notes (Security Update) — fixed build 24.1.3
🔗 References (3)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21322
- patchhttps://docs.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-the-on-premises-management-console#update-the-software-version
- referencehttps://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes#versions-241x