{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Claudio Bozzato with \u003ca href=\"https://talosintelligence.com/\"\u003eCisco Talos\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2021-41375 Azure Sphere Information Disclosure Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41375"
      },
      {
        "category": "self",
        "summary": "CVE-2021-41375 Azure Sphere Information Disclosure Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2021/msrc_cve-2021-41375.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Sphere Information Disclosure Vulnerability",
    "tracking": {
      "current_release_date": "2021-11-09T08:00:00.000Z",
      "generator": {
        "date": "2026-01-06T16:30:40.819Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2021-41375",
      "initial_release_date": "2021-11-09T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2021-11-09T08:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c22.07",
            "product": {
              "name": "Azure Sphere \u003c22.07",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "22.07",
            "product": {
              "name": "Azure Sphere 22.07",
              "product_id": "11796"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Sphere"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-41375",
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "All versions of Azure Sphere that are 21.10 and higher are protected from this vulnerability.\nIf your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.10 has been installed using the Azure Sphere CLI command:\nazsphere device show-os-version\nIf the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command:\nazsphere device show-deployment-status\nAn IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability. More information on Azure Sphere\u2019s CVE principles can be found on https://docs.microsoft.com/en-us/azure-sphere/deployment/azure-sphere-cves",
          "title": "What version of Azure Sphere has the update that protects from this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "11796"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2021-41375 Azure Sphere Information Disclosure Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41375"
        },
        {
          "category": "self",
          "summary": "CVE-2021-41375 Azure Sphere Information Disclosure Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2021/msrc_cve-2021-41375.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-11-09T08:00:00.000Z",
          "details": "22.07:Security Update:https://azure.microsoft.com/en-us/updates/general-availability-azure-sphere-os-version-2110/",
          "product_ids": [
            "1"
          ],
          "url": "https://azure.microsoft.com/en-us/updates/general-availability-azure-sphere-os-version-2110/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 3.9,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Information Disclosure"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Sphere Information Disclosure Vulnerability"
    }
  ]
}