PT-2023-30904 · Microsoft · Azure Rtos Usbx

Rkolandaivel · Published 2023-12-04 · Updated 2025-10-27 · CVE-2023-48695

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions 6.2.1 and below

Description Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and device classes, related to CDC ECM and RNDIS.

Recommendations For Azure RTOS USBX versions 6.2.1 and below, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the host and device classes, specifically those related to CDC ECM and RNDIS, until the upgrade is applied.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-48695

GHSA-MWJ9-RPPH-V8WC

Affected Products

Azure Rtos Usbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48695.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48695 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48695 · Vendor Advisory
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-mwj9-rpph-v8wc · Note
• https://t.me/cvenotify/62994 · Telegram Post
• https://t.me/cvenotify/62233 · Telegram Post
• https://twitter.com/CVEnew/status/1731842501563289859 · Twitter Post
• https://t.me/cveNotify/140466 · Telegram Post