PT-2023-30905 · Microsoft · Azure Rtos Usbx

Publicado 2023-12-04 · Atualizado 2025-10-27 · CVE-2023-48696

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions 6.2.1 and below

Description An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM.

Recommendations For Azure RTOS USBX versions 6.2.1 and below, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the host class components related to CDC ACM until the upgrade is applied. Note that there are no known workarounds for this vulnerability, so upgrading to the fixed version is the recommended course of action.

Exploit

Correção

RCE

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

CWE-825

Identificadores relacionados

CVE-2023-48696

GHSA-H733-98HQ-F884

Produtos afetados

Azure Rtos Usbx

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48696.json · Exploit
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-h733-98hq-f884 · Nota
• https://t.me/cvenotify/62234 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48696 · Nota de Segurança
• https://t.me/cvenotify/63002 · Publicação no Telegram
• https://t.me/cveNotify/140467 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1731842500338573485 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-48696 · Aviso do Fabricante