The vulnerability permits exposure of sensitive information in Azure IoT Central, which can then be used by an authorized attacker to elevate privileges over the network. This results in the attacker gaining higher-level permissions, potentially enabling unrestricted access to devices, configuration data, and administrative controls.

The affected product is Microsoft Azure IoT Central. No specific version information is provided in the advisory, so all current releases are potentially impacted until a patch is applied.

With a CVSS score of 9.9 the flaw is considered critical. The EPSS score shows a very low probability of exploitation, and it is not listed in the CISA KEV catalog. While the attack vector is not explicitly disclosed, it is inferred that an attacker who already has legitimate access to the Azure IoT Central environment could uncover sensitive data and subsequently exploit it to gain elevated privileges. Organizations should therefore assume the risk exists for privileged accounts and monitor for anomalous privilege changes.