Microsoft Entra Device Registration: Vulnerability Allows Privilege Escalation
A BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The BSI advisory describes a privilege escalation in Microsoft Entra Device Registration but provides no CVE ID, CVSS score, or exploitation details.
Description
A vulnerability exists in Microsoft Entra Device Registration that is said to allow a remote, anonymous attacker to escalate privileges. The BSI advisory provides no CVE ID, no CVSS score, and no information on exploitation or affected versions. The affected component is device registration in the Microsoft Entra identity service, which is used to manage devices in cloud and hybrid environments. Whether a proof of concept or active exploitation exists is not stated in the advisory. The status is therefore to be classified as an unconfirmed vulnerability without published technical details.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational