Out-of-bounds write in NetX Duo - CVE-2023-48315
Published: December 3, 2023 / Updated: November 9, 2026
Vulnerability identifier: #VU162951
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-48315
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on a device running affected Azure RTOS NetX Duo components.
The vulnerability exists due to a memory overflow during network input processing in the FTP and SNTP components of NetX Duo. An unauthenticated remote attacker can exploit the affected protocol processing to execute code, but successful exploitation requires user interaction.
Affected software
NetX Duo
How to mitigate CVE-2023-48315
Install security update from vendor's website.
NetX Duo - update to 6.3.0