Product:
Azure Connected Machine Agent
Summary
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. This vulnerability can lead to significant security risks as it enables unauthorized access to sensitive resources. Attackers with low privileges can exploit this flaw to gain higher-level access.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7 | CVE-2025-47989 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system running the Azure Connected Machine Agent. By leveraging improper access controls, the attacker can execute malicious actions that elevate their privileges, potentially compromising the integrity and confidentiality of the system.
Affected Products
- Azure Connected Machine Agent: A service that allows users to manage and monitor their Azure resources from on-premises environments.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security updates provided by Microsoft. Additionally, implementing strict access controls and monitoring local access to systems can help reduce the risk of exploitation.