PT-2023-7500 · Microsoft · Azure Rtos Usbx

Published 2023-11-17 · Updated 2025-10-27 · CVE-2023-48698

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure RTOS USBX versions prior to 6.3.0

Description The issue is related to expired pointer dereference vulnerabilities in Azure RTOS USBX, which can lead to remote code execution. The affected components include functions and processes in the host stack and host classes, related to device linked classes, GSER, and HID. An attacker can exploit this issue due to insufficient checking of exceptional states resulting from dereferencing an expired pointer.

Recommendations For Azure RTOS USBX versions prior to 6.3.0, upgrade to release 6.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the GSER and HID interfaces in the USB host until the update is applied. Avoid using the affected functions and processes in the host stack and host classes related to device linked classes until the issue is resolved.

Exploit

Fix

RCE

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-825

Related Identifiers

BDU:2023-08545

CVE-2023-48698

GHSA-GRHP-F66Q-X857

Affected Products

Azure Rtos Usbx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48698.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-48698 · Security Note
• https://bdu.fstec.ru/vul/2023-08545 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48698 · Vendor Advisory
• https://github.com/azure-rtos/usbx/security/advisories/GHSA-grhp-f66q-x857 · Note
• https://twitter.com/CVEnew/status/1731842498128208264 · Twitter Post
• https://t.me/cveNotify/140469 · Telegram Post
• https://vuldb.com/ru/?id.246807 · Note