Out-of-bounds write in NetX Duo - CVE-2023-48691
Published: December 3, 2023 / Updated: November 9, 2026
Vulnerability identifier: #VU162953
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-48691
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to potentially execute arbitrary code on a device running Azure RTOS NetX Duo.
The vulnerability exists due to an out-of-bounds write in the component responsible for processing Internet Group Management Protocol traffic. An unauthenticated remote attacker can trigger the write through IGMP processing, potentially causing memory corruption that leads to remote code execution.
Affected software
NetX Duo
How to mitigate CVE-2023-48691
Install security update from vendor's website.
NetX Duo - update to 6.3.0