The vulnerability in Microsoft Azure IoT Explorer allows sensitive information to be transmitted in cleartext, enabling an unauthorized attacker to capture and disclose confidential data. It represents a classic instance of the weakness described by CWE-319, Cleartext Transmission of Sensitive Information, and primarily compromises the confidentiality of the data exchanged by the Explorer application.

Affected by this vulnerability is Microsoft Azure IoT Explorer. No specific product versions are listed in the CNA data; the vulnerability applies to all versions of Azure IoT Explorer identified by the common platform enumeration cpe:2.3:a:microsoft:azure_iot_explorer:*:*:*:*:*:*:*:*.

The vulnerability has a CVSS score of 7.5, indicating a high impact severity. EPSS indicates an exploit probability of less than 1%, suggesting that exploitation is unlikely to occur spontaneously in the near term. The vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be network-based: an attacker capable of intercepting traffic between Azure IoT Explorer and its associated services can read the cleartext data. The risk is significant for environments where sensitive data is transmitted without encryption and where the network may be accessible to untrusted actors.