PT-2023-30903 · Microsoft · Azure Rtos Usbx

Published 2023-12-04 · Updated 2025-10-27 · CVE-2023-48694

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions prior to 6.3.0

Description Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM.

Recommendations For Azure RTOS USBX versions prior to 6.3.0, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable components, such as functions/processes in host stack and host class, until the upgrade is applied.

Exploit

Fix

RCE

Type Confusion

Weakness Enumeration

CWE-843

CWE-825

Related Identifiers

CVE-2023-48694

GHSA-QJW8-7W86-44QJ

Affected Products

Azure Rtos Usbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48694.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-48694 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48694 · Security Note
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-qjw8-7w86-44qj · Note
• https://t.me/cvenotify/63001 · Telegram Post
• https://twitter.com/CVEnew/status/1731842502679040366 · Twitter Post
• https://t.me/cvenotify/62232 · Telegram Post
• https://t.me/cveNotify/140465 · Telegram Post