Critical Flaws in Microsoft Azure Defender for IoT Enabled Unauthenticated RCE

SentinelLabs disclosed multiple critical vulnerabilities in Microsoft Azure Defender for IoT that affected both cloud-connected and on-premises deployments and could allow attackers to compromise appliances without authentication. The issues included weaknesses in the password recovery workflow, such as a time-of-check/time-of-use race condition and logic flaws in certificate and subscription validation, tracked in part as CVE-2021-42310, which could let an attacker reset privileged passwords and take over administrative accounts.

The report also detailed a command injection flaw that could lead to root remote code execution after account takeover (CVE-2021-42312), unauthenticated SQL injection bugs in token-related endpoints that could expose session IDs and enable further compromise (CVE-2021-42313 and CVE-2021-42311), and a heap-based buffer overflow in the RCDCAP traffic-processing component (CVE-2021-37222). Microsoft issued security updates and advisories after responsible disclosure, and SentinelLabs said it had not observed active exploitation in the wild at the time of publication.