CVE-2020-16970
published 2020-11-11CVE-2020-16970: Azure Sphere Unsigned Code Execution Vulnerability
PriorityP346high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
1.38%
68.9th percentile
Azure Sphere Unsigned Code Execution Vulnerability
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | azure_sphere | < 20.07 | 20.07 |
| microsoft | azure_sphere | >= 20.00 < publication | publication |
| msrc | azure_sphere | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_msrc8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x5v4-47j6-mq5c: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020
ghsa_unreviewed·2022-05-24·CVSS 8.1
CVE-2020-16982 [HIGH] GHSA-x5v4-47j6-mq5c: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020
Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020-16994.
GHSA
GHSA-rrf3-xmpm-r2cg: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020
ghsa_unreviewed·2022-05-24·CVSS 6.1
CVE-2020-16970 [MEDIUM] CWE-415 GHSA-rrf3-xmpm-r2cg: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020
Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991, CVE-2020-16994.
GHSA
GHSA-9ghx-jx5p-8hcc: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16991, CVE-2020
ghsa_unreviewed·2022-05-24·CVSS 8.1
CVE-2020-16987 [HIGH] GHSA-9ghx-jx5p-8hcc: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16991, CVE-2020
Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16991, CVE-2020-16994.
GHSA
GHSA-5wcg-gp2m-75xf: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020
ghsa_unreviewed·2022-05-24·CVSS 8.1
CVE-2020-16991 [HIGH] GHSA-5wcg-gp2m-75xf: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020
Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16994.
GHSA
GHSA-q538-v3qg-676x: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16987, CVE-2020-16991, CVE-2020
ghsa_unreviewed·2022-05-24·CVSS 8.1
CVE-2020-16984 [HIGH] GHSA-q538-v3qg-676x: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16987, CVE-2020-16991, CVE-2020
Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16987, CVE-2020-16991, CVE-2020-16994.
GHSA
GHSA-6p77-w4vc-3q5j: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020
ghsa_unreviewed·2022-05-24·CVSS 8.1
CVE-2020-16994 [HIGH] GHSA-6p77-w4vc-3q5j: Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020
Azure Sphere Unsigned Code Execution Vulnerability This CVE ID is unique from CVE-2020-16970, CVE-2020-16982, CVE-2020-16984, CVE-2020-16987, CVE-2020-16991.
Microsoft
Azure Sphere Unsigned Code Execution Vulnerability
vendor_msrc·2020-11-10·CVSS 8.1
CVE-2020-16970 [HIGH] Azure Sphere Unsigned Code Execution Vulnerability
Azure Sphere Unsigned Code Execution Vulnerability
FAQ: Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?
An IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability.
FAQ: This is the first time that a CVE has been issued against Azure Sphere. Why is that?
The Azure Sphere and MSRC bounty team completed a three-month security research challenge, in which we invited researchers to find and report vulnerabilities in the Azure Sphere OS. We appreciate all of the hard work of the researchers, and will be opening up several CVEs to record and reflect this work. More
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16970https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1118https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16970https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1118
2020-11-11
Published