The vulnerability arises from improper restriction of a communication channel to intended endpoints in Azure IoT Explorer. An attacker who can interact with the device over the network could gain unauthorized access to sensitive information without higher privileges. This weakness is classified as CWE-923, which indicates that confidential data may be disclosed to an attacker who should not have access to it. The potential impact is primarily confidentiality loss; there is no indication of denial of service or persistence in the official description.

Affected users are those who run Microsoft Azure IoT Explorer. The CVE entry does not list specific affected versions or release notes, so any installation of Azure IoT Explorer that has not yet applied the official update may be vulnerable. It is recommended to verify the version against Microsoft’s advisory referenced in the CVE entry.

The CVSS score is 7.5, indicating a high severity vulnerability when exploited. The EPSS score is below 1 %, suggesting that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in CISA’s KEV catalog, so there are no publicly documented exploits to date. Based on the description, the likely attack vector would require network access to the device; an attacker must be able to communicate with the IoT Explorer or the device it manages.