Cyber Resilience

CVE-2025-24049

High

Published: 11 March 2025

Published
11 March 2025
Modified
02 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 32.1th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24049 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft Azure Command-Line Interface. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-24049 is a command injection vulnerability (CWE-77) in Azure Command Line Integration (CLI), resulting from improper neutralization of special elements used in a command. This flaw affects the Azure CLI component and was published on 2025-03-11, carrying a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A local attacker requires no privileges (PR:N) to exploit the vulnerability, which demands low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables local privilege escalation, granting high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U).

Microsoft's security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24049 details mitigation strategies and available patches.

EU & UK References

Vulnerability details

Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Command injection vulnerability in Azure CLI directly enables arbitrary command execution via T1059 and local privilege escalation via T1068.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-21257Same vendor: Microsoft
CVE-2025-64671Same vendor: Microsoft
CVE-2025-59272Same vendor: Microsoft
CVE-2025-59286Same vendor: Microsoft
CVE-2025-55227Same vendor: Microsoft
CVE-2025-59252Same vendor: Microsoft
CVE-2026-35428Same vendor: Microsoft
CVE-2026-32194Same vendor: Microsoft
CVE-2026-20841Same vendor: Microsoft
CVE-2026-32183Same vendor: Microsoft

Affected Assets

microsoft
azure command-line interface
≤ 2.69.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses command injection (CWE-77) by requiring validation mechanisms to neutralize special elements in inputs to the Azure CLI.

SI-2 Flaw Remediation good match
prevent

Enables timely remediation of the specific flaw in Azure CLI through monitoring advisories and applying patches as detailed in Microsoft's security advisory.

AC-6 Least Privilege partial match
prevent

Mitigates the impact of local privilege escalation by enforcing least privilege, limiting the scope of damage even if injection succeeds.

References