PT-2023-30905 · Microsoft · Azure Rtos Usbx

Published 2023-12-04 · Updated 2025-10-27 · CVE-2023-48696

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions 6.2.1 and below

Description An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM.

Recommendations For Azure RTOS USBX versions 6.2.1 and below, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the host class components related to CDC ACM until the upgrade is applied. Note that there are no known workarounds for this vulnerability, so upgrading to the fixed version is the recommended course of action.

Exploit

Fix

RCE

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-825

Related Identifiers

CVE-2023-48696

GHSA-H733-98HQ-F884

Affected Products

Azure Rtos Usbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48696.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48696 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48696 · Vendor Advisory
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-h733-98hq-f884 · Note
• https://t.me/cvenotify/62234 · Telegram Post
• https://t.me/cvenotify/63002 · Telegram Post
• https://t.me/cveNotify/140467 · Telegram Post
• https://twitter.com/CVEnew/status/1731842500338573485 · Twitter Post