PT-2025-31706 · Microsoft · Himmelblau+2

Carlesgs · Published 2025-08-01 · Updated 2025-08-02 · CVE-2025-54781

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Himmelblau version 1.0.0 versions prior to 1.1.0

Description Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau, the himmelblaud tasks service leaks an Intune service access token to the system journal. This token can be used to detect the host's Intune compliance status and may permit additional administrative operations for the Intune host device.

Recommendations Ensure that Himmelblau debugging is disabled for version 1.0.0. Update to version 1.1.0 or later.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-54781

GHSA-78QG-VMRW-574W

Affected Products

Himmelblau

Intune

Azure Entra Id

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54781.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54781 · Security Note
• https://github.com/himmelblau-idm/himmelblau/commit/2d512bded90ac6a54fcdf737b43ff5d9d4cdb59e · Note
• https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-78qg-vmrw-574w · Note
• https://github.com/himmelblau-idm/himmelblau/releases/tag/1.1.0 · Note
• https://twitter.com/CVEnew/status/1951431043786866700 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1951457450961314109 · Twitter Post
• https://t.me/CVEtracker/28993 · Telegram Post
• https://t.me/cveNotify/130641 · Telegram Post