CVE-2023-48315

Azure RTOS NetX Duo Remote Code Execution Vulnerability

State: Published
Severity: 8.8 High
Published: Dec 5, 2023
Updated: Nov 27, 2024
Reserved: Nov 14, 2023

Description

Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to ftp and sntp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-787 Out-of-bounds Write
CWE-825 Expired Pointer Dereference

Affected Products

Product	Versions
netxduoazure-rtos	< 6.3.0Affected

References

https://github.com/azure-rtos/netxduo/security/advisories/GHSA-rj6h-jjg2-7gf3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.