AVID-2026-R1684

Description

Azure AI Bot Elevation of Privilege Vulnerability (CVE-2025-30392)

Details

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Reason for inclusion in AVID: The CVE describes an improper authorization vulnerability in the Azure Bot Framework SDK, enabling privilege escalation over a network. This is a software vulnerability in a component (Azure Bot Service/SDK) used to build or deploy AI-driven bots, which are part of AI systems and their software supply chains. The issue affects the tooling/runtime used to run AI bots, fitting the general-purpose AI (GP AI) supply chain, and it is a security vulnerability with clear CVE/NVD/MSRC references.

References

Affected or Relevant Artifacts

Developer: Microsoft
Deployer: Microsoft
Artifact Details:

Type	Name
System	Azure AI Bot Service

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Base Score	9.8
Base Severity	🔴 Critical

CWE

ID	Description
CWE-285	CWE-285: Improper Authorization

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-04-30
Version: 0.3.3
AVID Entry