CVE-2025-24070: microsoft asp.net_core Weak Authentication

CVSS: 7.0v3.1HighAnalyzed

AliasesRHSA-2025:2666RHSA-2025:2667RHSA-2025:2668+6 more

Published 11-03-2025Last modified 13-02-2026

Vulnerability summary

CVE-2025-24070 is a high (CVSS 7.0) Weak Authentication vulnerability in microsoft asp.net_core. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.0/10

010

High · v3.1 (CVE.org)

EPSS score

1.01%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

11-03-2025
PublishedVulnerability first disclosed.
13-02-2026
Last modifiedVulnerability information updated.

Description

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.0

EPSS trend

Probability

1.01%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

+0.03 pp

From 0.98% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.01%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (herodevs.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-1390Weak AuthenticationThe product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Affected systems

Redhat44 products

aspnetcore-runtime-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
aspnetcore-runtime-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
aspnetcore-runtime-dbg-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
aspnetcore-runtime-dbg-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
aspnetcore-targeting-pack-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10

aspnetcore-targeting-pack-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet< 0:9.0.104-1.el8_10
dotnet-apphost-pack-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-apphost-pack-8.0-debuginfo< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-apphost-pack-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-apphost-pack-9.0-debuginfo< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-host< 0:8.0.14-1.el9_4 | < 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-host-debuginfo< 0:8.0.14-1.el9_4 | < 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-hostfxr-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-hostfxr-8.0-debuginfo< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-hostfxr-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-hostfxr-9.0-debuginfo< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-runtime-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-runtime-8.0-debuginfo< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-runtime-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-runtime-9.0-debuginfo< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-runtime-dbg-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-runtime-dbg-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-sdk-8.0< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet-sdk-8.0-debuginfo< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet-sdk-8.0-source-built-artifacts< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet-sdk-9.0< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet-sdk-9.0-debuginfo< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet-sdk-9.0-source-built-artifacts< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet-sdk-aot-9.0< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet-sdk-aot-9.0-debuginfo< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet-sdk-dbg-8.0< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet-sdk-dbg-9.0< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet-targeting-pack-8.0< 0:8.0.14-1.el9_4 | < 0:8.0.14-1.el9_5 | < 0:8.0.14-1.el8_10
dotnet-targeting-pack-9.0< 0:9.0.3-1.el8_10 | < 0:9.0.3-1.el9_5
dotnet-templates-8.0< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet-templates-9.0< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet8.0< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet8.0-debuginfo< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet8.0-debugsource< 0:8.0.114-1.el9_4 | < 0:8.0.114-1.el9_5 | < 0:8.0.114-1.el8_10
dotnet9.0< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet9.0-debuginfo< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
dotnet9.0-debugsource< 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5
netstandard-targeting-pack-2.1< 0:8.0.114-1.el9_4 | < 0:9.0.104-1.el8_10 | < 0:9.0.104-1.el9_5

Show all 44

NuGet13 products

Microsoft.AspNetCore.App.Runtime.linux-arm≥ 9.0.0, < 9.0.3 | ≥ 8.0.0, < 8.0.14 | ≥ 6.0.0, ≤ 6.0.36
Microsoft.AspNetCore.App.Runtime.linux-arm64≥ 9.0.0, < 9.0.3 | ≥ 8.0.0, < 8.0.14 | ≥ 6.0.0, ≤ 6.0.36
Microsoft.AspNetCore.App.Runtime.linux-musl-arm≥ 9.0.0, < 9.0.3 | ≥ 8.0.0, < 8.0.14 | ≥ 6.0.0, ≤ 6.0.36
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64≥ 9.0.0, < 9.0.3 | ≥ 8.0.0, < 8.0.14 | ≥ 6.0.0, ≤ 6.0.36
Microsoft.AspNetCore.App.Runtime.linux-musl-x64≥ 9.0.0, < 9.0.3 | ≥ 8.0.0, < 8.0.14 | ≥ 6.0.0, ≤ 6.0.36

Show all 13

Microsoft8 products

asp.net_core≥ 8.0.0, < 8.0.14 | ≥ 9.0.0, < 9.0.3
asp.net core 8.0≥ 8.0, < 8.0.14
asp.net core 9.0≥ 9.0, < 9.0.3
microsoft visual studio 2022 version 17.10≥ 17.10.0, < 17.10.12
microsoft visual studio 2022 version 17.12≥ 17.12.0, < 17.12.6

Show all 8

Ubuntu3 products

dotnet6All versions (No fix recorded)
dotnet7All versions (No fix recorded)
dotnet8< 8.0.114-8.0.14-0ubuntu1~22.04.1 | < 8.0.114-8.0.14-0ubuntu1~24.04.1

4 vendors · 68 products

References

22 links

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070Vendor AdvisoryPatchREPORTWEB
www.herodevs.com/vulnerability-directory/cve-2025-24070WEBExploitThird Party Advisory
access.redhat.com/errata/RHSA-2025:2666Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2349733REPORT
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2666.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-24070REPORT
www.cve.org/CVERecord?id=CVE-2025-24070AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2025-24070Advisory
access.redhat.com/errata/RHSA-2025:2667Advisory

Show all 22 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities