CVE-2023-48695
High
Description
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and device classes, related to CDC ECM and RNDIS in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityHigh
CVSS7.3
Exploit probability—
ProductEclipse Threadx Usbx
PublishedDec 5, 2023
First seenDec 5, 2023
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- eclipse threadx_usbx6.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse threadx_usbx | v < 6.3.0 | 6.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.