CVE-2025-24070

Published: Mar 11, 2025Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 2.2 / Impact: 4.7

Source: secure@microsoft.com (Secondary)

Description

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Affected (6)

Products: Microsoft: Asp.net Core, Visual Studio 2022

2 products

Visual Studio 2022

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft Asp.net Core	8.0.0 ≤ version < 8.0.14
Microsoft Asp.net Core	9.0.0 ≤ version < 9.0.3
Microsoft Visual Studio 2022	17.10.0 ≤ version < 17.10.12
Microsoft Visual Studio 2022	17.12.0 ≤ version < 17.12.6
Microsoft Visual Studio 2022	17.13.0 ≤ version < 17.13.3
Microsoft Visual Studio 2022	17.8.0 ≤ version < 17.8.19

Related CWEs

Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

References (2)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070

Source: secure@microsoft.com

Vendor Advisory

https://www.herodevs.com/vulnerability-directory/cve-2025-24070

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.