AVID-2026-R0923

Description

Bot Framework SDK Remote Code Execution Vulnerability (CVE-2021-43225)

Details

Bot Framework SDK Remote Code Execution Vulnerability

Reason for inclusion in AVID: CVE-2021-43225 is a remote code execution vulnerability in the Bot Framework SDK for .NET Framework. The Bot Framework SDK is a software component commonly used to build and deploy AI chatbots and conversational agents, i.e., it is part of the software stack used to create AI systems. This constitutes a software supply-chain issue for AI systems (dependencies/runtime used in AI pipelines), not hardware/firmware. The vulnerability is security-focused (RCE) with published CVE/NVD/MSRC references, providing sufficient evidence.

References

Affected or Relevant Artifacts

Developer: Microsoft
Deployer: Microsoft
Artifact Details:

Type	Name
System	Bot Framework SDK for .NET Framework

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Base Score	7.5
Base Severity	🔴 High

Other information

Report Type: Advisory
Credits:
Date Reported: 2021-12-15
Version: 0.3.3
AVID Entry