Entra Device Registration authorization bypass allows privilege escalation
Microsoft's device registration cloud service can let attackers take higher privileges!
Summary
Authorization can be bypassed through a user-controlled key in Entra Device Registration. An unauthorized attacker on the network can elevate privileges.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- Advisory: msrc.microsoft.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen