PT-2023-30906 · Microsoft · Azure Rtos Usbx

Published 2023-12-04 · Updated 2025-10-27 · CVE-2023-48697

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions 6.2.1 and below

Description An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in pictbridge and host class, related to PIMA, storage, CDC ACM, ECM, audio, hub.

Recommendations For Azure RTOS USBX versions 6.2.1 and below, upgrade to USBX release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable components, such as pictbridge and host class functions, until the upgrade is applied. Avoid using the affected functions/processes related to PIMA, storage, CDC ACM, ECM, audio, hub in RTOS until the issue is resolved.

Exploit

Fix

RCE

Memory Corruption

NULL Pointer Dereference

Weakness Enumeration

CWE-787

CWE-825

CWE-476

Related Identifiers

CVE-2023-48697

GHSA-P2P9-WP2Q-WJV4

Affected Products

Azure Rtos Usbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48697.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48697 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48697 · Vendor Advisory
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-p2p9-wp2q-wjv4 · Note
• https://twitter.com/CVEnew/status/1731842499264803195 · Twitter Post
• https://t.me/cvenotify/62235 · Telegram Post
• https://t.me/cvenotify/63003 · Telegram Post
• https://t.me/cveNotify/140468 · Telegram Post