Azure Stack Edge devices are vulnerable to remote code execution when an attacker can supply an unauthorized file name or path. The flaw allows the attacker to control the file placed on the device, leading to execution of arbitrary code over the network. The weakness is a classic example of external control of a filename or path, and is classified as CWE‑73, indicating insufficient validation of user‑controlled input. Additionally, this vulnerability involves CWE‑610, an improper restriction of operations within the bounds of a resource, as the attacker can potentially write or execute files in arbitrary locations on the device.

The vulnerability affects Microsoft Azure Stack Edge devices, but no specific firmware or software versions were provided in the advisories. All deployments using Azure Stack Edge should be examined for the presence of the unpatched code path that allows uncontrolled file naming.

The CVSS score for this vulnerability is 9.8, indicating a critical level of severity. The EPSS score is less than 1 %, so the current likelihood of exploitation is low, but the full impact would be devastating. The vulnerability is not listed in the CISA KEV catalog. The flaw allows an unauthenticated attacker that can reach the Azure Stack Edge device’s management or file upload interfaces to supply a malicious path to trigger code execution. The absence of an authentication requirement in the description implies that the flaw could be abused by outsiders with network access to the device.