Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-21323 is a high-severity Absolute Path Traversal (CWE-36) vulnerability in Microsoft Defender For Iot. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Microsoft Defender for IoT contains a remote code execution vulnerability identified as CVE-2024-21323. The flaw carries a CVSS 3.1 score of 8.8 and is associated with CWE-36. It affects the Defender for IoT product and permits an attacker to execute arbitrary code on affected systems.
An authenticated attacker with low privileges can exploit the issue over the network with low attack complexity and no user interaction required. Successful exploitation grants full control over confidentiality, integrity, and availability on the target, enabling remote code execution within the impacted environment.
The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21323 provides patch and mitigation guidance for the vulnerability. The associated EPSS score has remained flat at 0.1027 since disclosure with no observed upward trajectory.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19035
Vulnerability Data
Microsoft Defender for IoT Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops construction of absolute paths from untrusted data before they reach file operations.
Enforced access authorizations can limit which resources are reachable even if a traversal succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent absolute path traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect absolute path traversal via static analysis and fuzzing.
Secure development lifecycle includes input validation and path-handling requirements that reduce absolute path traversal risk.
Application security requirements typically mandate controls against path traversal in file-access functions.
Secure architecture principles call for canonicalization and sandboxing that limit absolute path traversal.
Secure coding standards directly require neutralization of absolute path sequences in pathname construction.
Information access restriction limits which files can be reached but does not address the path-construction flaw itself.