Critical severity · published Dec 5, 2023
CVE-2023-48692
Azure RTOS NetX Duo Remote Code Execution Vulnerability
9.8
CVSS
3.1%
EPSS
No
On KEV
Description
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netxduo · azure-rtos
< 6.3.0 · source: vendor
AR
Azure Rtos Netx Duo · Microsoft
before 6.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48692
Third Party Advisory
https://github.com/azure-rtos/netxduo/security/advisories/GHSA-m2rx-243p-9w64
More from netxduo
9.8
CVE-2023-48691
Azure RTOS NetX Duo Remote Code Execution Vulnerability
9.8
CVE-2023-48316
Azure RTOS NetX Duo Remote Code Execution Vulnerability
9.8
CVE-2023-48315
Azure RTOS NetX Duo Remote Code Execution Vulnerability