PT-2023-30904 · Microsoft · Azure Rtos Usbx

Rkolandaivel · Publicado 2023-12-04 · Atualizado 2025-10-27 · CVE-2023-48695

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions 6.2.1 and below

Description Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and device classes, related to CDC ECM and RNDIS.

Recommendations For Azure RTOS USBX versions 6.2.1 and below, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the host and device classes, specifically those related to CDC ECM and RNDIS, until the upgrade is applied.

Exploit

Correção

RCE

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2023-48695

GHSA-MWJ9-RPPH-V8WC

Produtos afetados

Azure Rtos Usbx

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48695.json · Exploit
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-mwj9-rpph-v8wc · Nota
• https://t.me/cvenotify/62994 · Publicação no Telegram
• https://t.me/cvenotify/62233 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48695 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48695 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1731842501563289859 · Publicação no Twitter
• https://t.me/cveNotify/140466 · Publicação no Telegram