Out-of-bounds write in NetX Duo - CVE-2023-48692
Published: December 3, 2023 / Updated: November 9, 2026
Vulnerability identifier: #VU162954
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-48692
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on devices running Azure RTOS NetX Duo.
The vulnerability exists due to memory overflows in NetX Duo network protocol processing functions when handling attacker-controlled network input. An unauthenticated remote attacker can send crafted traffic to an affected protocol handler to trigger an out-of-bounds write and achieve code execution without victim interaction.
Affected software
NetX Duo
How to mitigate CVE-2023-48692
Install security update from vendor's website.
NetX Duo - update to 6.3.0