CVE-2024-38179— Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability
Quick assessment
Affected
Microsoft Azure Stack HCI OS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Microsoft Azure Stack是美国微软（Microsoft）公司的一款基于Azure云平台的混合云计算软件解决方案。该产品支持构建和部署混合应用程序。 Microsoft Azure Stack存在安全漏洞。攻击者利用该漏洞可以提升权限。以下产品和版本受到影响：Azure Stack HCI 22H2,Azure Stack HCI 23H2。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Microsoft | Azure Stack HCI OS | 10.0.25398.0< 10.0.25398.1189 |
affected |
| Microsoft | Azure Stack OS HCI | 10.0.20349.0< 10.0.20349.2762 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-38179
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Microsoft Azure Stack 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Azure Stack是美国微软（Microsoft）公司的一款基于Azure云平台的混合云计算软件解决方案。该产品支持构建和部署混合应用程序。 Microsoft Azure Stack存在安全漏洞。攻击者利用该漏洞可以提升权限。以下产品和版本受到影响：Azure Stack HCI 22H2,Azure Stack HCI 23H2。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Microsoft | Azure Stack HCI OS | 10.0.25398.0 ~ 10.0.25398.1189 | - |
|
| Microsoft | Azure Stack OS HCI | 10.0.20349.0 ~ 10.0.20349.2762 | - |
|
II. Public POCs for CVE-2024-38179
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-38179
请登录查看更多情报信息。
Same Patch Batch · Microsoft · 2024-10-08 · 117 CVEs total
| CVE-2024-43468 | 9.8 CRITICAL | Microsoft Configuration Manager Remote Code Execution Vulnerability |
| CVE-2024-38124 | 9.0 CRITICAL | Windows Netlogon Elevation of Privilege Vulnerability |
| CVE-2024-43611 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43488 | 8.8 HIGH | Visual Studio Code extension for Arduino Remote Code Execution Vulnerability |
| CVE-2024-43453 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43517 | 8.8 HIGH | Microsoft ActiveX Data Objects Remote Code Execution Vulnerability |
| CVE-2024-38212 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-38265 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43607 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43549 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43608 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43533 | 8.8 HIGH | Remote Desktop Client Remote Code Execution Vulnerability |
| CVE-2024-43532 | 8.8 HIGH | Remote Registry Service Elevation of Privilege Vulnerability |
| CVE-2024-43519 | 8.8 HIGH | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-43564 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43518 | 8.8 HIGH | Windows Telephony Server Remote Code Execution Vulnerability |
| CVE-2024-43589 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43593 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2024-43599 | 8.8 HIGH | Remote Desktop Client Remote Code Execution Vulnerability |
| CVE-2024-43592 | 8.8 HIGH | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
Showing top 20 of 117 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Microsoft
-
CVE-2026-100208
Microsoft Office Outlook Remote Code Execution Vulnerability -
CVE-2026-70125
Microsoft Office Outlook Remote Code Execution Vulnerability -
CVE-2026-88097
Microsoft Edge (Chromium-based) Elevation of Privilege Vulne -
CVE-2026-85887
M365 Copilot Information Disclosure Vulnerability -
CVE-2026-83946
Azure Portal Spoofing Vulnerability
Same weakness: CWE-862
-
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorizatio -
CVE-2026-102375
WordPress Optimole plugin <= 4.2.14 - Broken Access Control -
CVE-2026-102397
WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broke -
CVE-2026-47493
NVIDIA vGPU驱动越权访问致代码执行漏洞 -
CVE-2026-47604
NVIDIA驱动缺失授权检查致信息泄露漏洞
V. Comments for CVE-2024-38179
No comments yet