CVE-2023-48698
Medium
Description
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host classes, related to device linked classes, GSER and HID in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityMedium
CVSS6.8
Exploit probability—
ProductEclipse Threadx Usbx
PublishedDec 5, 2023
First seenDec 5, 2023
Weakness typeCWE-754CWE-754CWE-825CWE-825
How to fix
Update
- eclipse threadx_usbx6.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse threadx_usbx | v < 6.3.0 | 6.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.