The vulnerability is a server‑side request forgery (SSRF) in Microsoft Azure IoT Explorer that enables an unauthorized attacker to cause the server to send arbitrary requests over the network, effectively spoofing internal services. The craft of the exploit relies on improper input validation (CWE‑20) and the SSRF weakness (CWE‑918). Attackers could thereby cause the IoT Explorer to request resources that appear legitimate, potentially leading to impersonation or other unauthorized network actions.

The affected product is Microsoft Azure IoT Explorer. Specific product versions impacted are not enumerated in the available data; only the product name is identified.

The CVSS score of 7.5 indicates a high severity, while the EPSS score below 1% suggests a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an SSRF enabled by an unauthorized attacker interacting with the IoT Explorer interface, but the exact conditions or required credentials are not detailed in the input. The exploitation path would involve sending a crafted request that the explorer validates poorly, leading it to forward the request to an arbitrary network destination, enabling spoofing of services inside the network.