PT-2023-30903 · Microsoft · Azure Rtos Usbx

CVE-2023-48694 · Publicado 2023-12-04 · Atualizado 2025-10-27

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions prior to 6.3.0

Description Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM.

Recommendations For Azure RTOS USBX versions prior to 6.3.0, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable components, such as functions/processes in host stack and host class, until the upgrade is applied.

Exploit

Correção

RCE

Type Confusion

Enumeração de Fraquezas

CWE-843

CWE-825

Identificadores relacionados

CVE-2023-48694

GHSA-QJW8-7W86-44QJ

Produtos afetados

Azure Rtos Usbx

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48694.json · Exploit
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj · Nota
• https://osv.dev/vulnerability/CVE-2023-48694 · Aviso do Fabricante
• https://t.me/cvenotify/63001 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1731842502679040366 · Publicação no Twitter
• https://t.me/cvenotify/62232 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48694 · Nota de Segurança
• https://t.me/cveNotify/140465 · Publicação no Telegram