Microsoft Azure Local Improper Certificate Validation Leading to Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Azure Local due to improper certificate validation. This issue allows an unauthorized attacker to execute code over the network. Exploitation involves intercepting unsecure communications between the configurator app and target machines, modifying responses to inject commands that execute arbitrary code with administrative privileges. The vulnerability affects Azure Local versions through 2510.0.3002.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system, with the executed code running with administrative privileges.

Remediation

Users are advised to download the security update for Azure Local available through the Microsoft Update Catalog. Instructions for applying the update can be found in the Azure Local release notes.