CVE-2023-48696: medium-severity vulnerability in azure-rtos usbx
Azure RTOS USBX Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.9%
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
azure-rtos · usbxRelated CVEs — azure-rtos usbx
In the same product, most dangerous first.
CVE-2022-39344CRITICALAzure RTOS USBX vulnerable to buffer overflow EPSS 2.7%CVE-2022-29246CRITICALPotential buffer overflow in function DFU upload in Azure RTOS USBXEPSS 2.4%CVE-2022-36063HIGHUSBX Host CDC ECM integer underflow with buffer overflowEPSS 2.2%CVE-2023-48694MEDIUMAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-29223HIGHBuffer overflow on HUB descriptor in Azure RTOS USBXEPSS 1.2%CVE-2023-48695HIGHAzure RTOS USBX Remote Code Execution VulnerabilityEPSS 1.2%