CVE-2025-47906 Affecting azuredisk-csi-fips-1.28 package, versions <1.28.12-r5

The vulnerable component is not bound to the network stack and the attacker's path is via read/write/execute capabilities.

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.

The vulnerable system can be exploited without interaction from any user.

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.

There is no loss of integrity within the impacted component.

There is no impact to availability within the impacted component.