CVE-2025-24070: high-severity vulnerability in Microsoft ASP.NET Core 8.0
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ASP.NET Core and Visual Studio have weak authentication that allows an attacker to gain higher privileges over a network without proper authorization. This can let someone access or control things they shouldn't be able to.
A weak authentication mechanism in ASP.NET Core and Visual Studio allows network-based privilege escalation by an unauthorized attacker. The vulnerability permits an unauthenticated or low-privileged user to elevate their access level remotely, potentially compromising application integrity and confidentiality depending on the affected component's role.
In the same product, most dangerous first.