SB2023120307 - Multiple vulnerabilities in NetX Duo

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023120307

SB2023120307 - Multiple vulnerabilities in NetX Duo

Published: December 3, 2023 Updated: November 9, 2026

Security Bulletin ID SB2023120307
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2023-48315)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on a device running affected Azure RTOS NetX Duo components.

The vulnerability exists due to a memory overflow during network input processing in the FTP and SNTP components of NetX Duo. An unauthenticated remote attacker can exploit the affected protocol processing to execute code, but successful exploitation requires user interaction.


2) Out-of-bounds write (CVE-ID: CVE-2023-48316)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on a device running Azure RTOS NetX Duo.

The vulnerability exists due to an out-of-bounds write when affected NetX Duo network protocol handlers process network traffic. An unauthenticated remote attacker can send malicious traffic to an affected protocol handler and trigger a memory overflow without requiring user interaction.


3) Out-of-bounds write (CVE-ID: CVE-2023-48691)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to potentially execute arbitrary code on a device running Azure RTOS NetX Duo.

The vulnerability exists due to an out-of-bounds write in the component responsible for processing Internet Group Management Protocol traffic. An unauthenticated remote attacker can trigger the write through IGMP processing, potentially causing memory corruption that leads to remote code execution.


4) Out-of-bounds write (CVE-ID: CVE-2023-48692)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on devices running Azure RTOS NetX Duo.

The vulnerability exists due to memory overflows in NetX Duo network protocol processing functions when handling attacker-controlled network input. An unauthenticated remote attacker can send crafted traffic to an affected protocol handler to trigger an out-of-bounds write and achieve code execution without victim interaction.


Remediation

Install update from vendor's website.

References