The vulnerability in the Network Device Enrollment Service arises from insufficient authentication checks, allowing an attacker who has already authenticated to pose as another device or service. This type of spoofing could enable the attacker to approve or obtain certificates that should belong to trusted devices, thereby compromising the integrity and confidentiality of network communications. The weakness is identified as CWE-1390, referring to authentication weaknesses that permit impersonation.

Microsoft Windows 10 Version 1607 and 1809, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations, are affected by this flaw.

The CVSS score of 6.8 indicates moderate severity, but the absence of an EPSS value means the existing exploit probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. Likely exploitation requires the attacker to already have been authenticated to the NDES subsystem; however, once authenticated, the attacker can masquerade as other devices within the network, potentially leading to unauthorized certificate issuance or other privileged actions. No remote unprivileged exploitation path is described, but the impact within an authenticated domain is significant.