Critical severity · published Dec 5, 2023
CVE-2023-48698
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host classes, related to device linked classes, GSER and HID in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Threadx Usbx · Eclipse
before 6.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48698
Third Party Advisory
https://github.com/azure-rtos/usbx/security/advisories/GHSA-grhp-f66q-x857
More from Threadx Usbx
9.8
CVE-2023-48697
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX
9.8
CVE-2023-48696
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX
9.8
CVE-2023-48695
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX
9.8
CVE-2023-48694
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX
9.8
CVE-2022-39293
Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflow