What’s Vulnerable › Vulnerabilities

CVE-2020-17002: Azure SDK for C Security Feature Bypass Vulnerability

• Severity: critical (CVSS 9.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-09 · updated 2026-06-17

Description

Azure SDK for C Security Feature Bypass Vulnerability

Affected products

• Microsoft C Sdk For Azure Iot: before lts_07_2020_ref02 — fixed in lts_07_2020_ref02
• Microsoft azure-c-shared-utility: before publication — fixed in publication
• Microsoft Azure-c-shared-utility Release LTS_02_2020_Ref02: before publication — fixed in publication
• Microsoft Azure-c-shared-utility Release LTS_07_2020_Ref02: before publication — fixed in publication
• Microsoft azure-uamqp-c: from 1.0.0 before publication — fixed in publication
• Microsoft azure-uamqp-c Release LTS_02_2020_Ref02: before publication — fixed in publication
• Microsoft azure-uamqp-c Release LTS_07_2020_Ref02: before publication — fixed in publication
• Microsoft azure-uhttp-c: before publication — fixed in publication
• Microsoft azure-uhttp-c Release LTS_02_2020_Ref02: before publication — fixed in publication
• Microsoft azure-uhttp-c Release LTS_07_2020_Ref02: before publication — fixed in publication
• Microsoft azure-umqtt-c: before publication — fixed in publication
• Microsoft azure-umqtt-c Release LTS_02_2020_Ref02: before publication — fixed in publication
• Microsoft azure-umqtt-c Release LTS_07_2020_Ref02: before publication — fixed in publication
• Microsoft azure-utpm-c: before publication — fixed in publication
• Microsoft azure-utpm-c Release LTS_02_2020_Ref02: before publication — fixed in publication
• Microsoft azure-utpm-c Release LTS_07_2020_Ref02: before publication — fixed in publication
• Microsoft C SDK for Azure IoT: before publication — fixed in publication
• Microsoft C SDK for Azure IoT Release LTS_02_2020_Ref02: before publication — fixed in publication
• Microsoft C SDK for Azure IoT Release LTS_07_2020_Ref02: before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft C Sdk For Azure Iot lts_07_2020_ref02; Microsoft azure-c-shared-utility publication; Microsoft Azure-c-shared-utility Release LTS_02_2020_Ref02 publication; Microsoft Azure-c-shared-utility Release LTS_07_2020_Ref02 publication; Microsoft azure-uamqp-c publication; Microsoft azure-uamqp-c Release LTS_02_2020_Ref02 publication; Microsoft azure-uamqp-c Release LTS_07_2020_Ref02 publication; Microsoft azure-uhttp-c publication; Microsoft azure-uhttp-c Release LTS_02_2020_Ref02 publication; Microsoft azure-uhttp-c Release LTS_07_2020_Ref02 publication; Microsoft azure-umqtt-c publication; Microsoft azure-umqtt-c Release LTS_02_2020_Ref02 publication. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17002
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17002

Get alerted when CVE-2020-17002 or the next vulnerability affects your stack