Critical severity · published Dec 5, 2023
CVE-2023-48691
Azure RTOS NetX Duo Remote Code Execution Vulnerability
9.8
CVSS
3.1%
EPSS
No
On KEV
Description
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netxduo · azure-rtos
< 6.3.0 · source: vendor
AR
Azure Rtos Netx Duo · Microsoft
before 6.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48691
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48691
Third Party Advisory
https://github.com/azure-rtos/netxduo/security/advisories/GHSA-fwmg-rj6g-w99p
More from netxduo
9.8
CVE-2023-48692
Azure RTOS NetX Duo Remote Code Execution Vulnerability
9.8
CVE-2023-48316
Azure RTOS NetX Duo Remote Code Execution Vulnerability
9.8
CVE-2023-48315
Azure RTOS NetX Duo Remote Code Execution Vulnerability