Azure Stack Edge devices are vulnerable to remote code execution when an attacker can supply an unauthorized file name or path. The flaw allows the attacker to control the file placed on the device, leading to execution of arbitrary code over the network. The weakness is a classic example of external control of a filename or path, and is classified as CWE‑73, indicating insufficient validation of user-controlled input.

The vulnerability affects Microsoft Azure Stack Edge devices, but no specific firmware or software versions were provided in the advisories. All deployments using Azure Stack Edge should be examined for the presence of the unpatched code path that allows uncontrolled file naming.

The CVSS score for this vulnerability is 9.8, indicating a critical level of severity. The EPSS score is not available, so the current risk of exploitation is unknown from that metric. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network: an unauthenticated attacker that can reach the Azure Stack Edge device’s management or file upload interfaces may supply a malicious path to trigger code execution. No authentication requirement is specified, implying that the flaw could be abused by outsiders with network access to the device.