CVE-2023-48696

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-48696

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48696.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-48696

Aliases

GHSA-h733-98hq-f884

Published

2023-12-05T00:24:57.565Z

Modified

2026-07-15T02:09:44.517638645Z

Severity

6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Azure RTOS USBX Remote Code Execution Vulnerability

Details

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference vulnerabilities in Azure RTOS USBX. The affected components include components in host class, related to CDC ACM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48696.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-754",
        "CWE-825"
    ]
}

References

Affected packages

Git / github.com/eclipse-threadx/usbx

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/usbx

Events

Introduced

Fixed

26585e42dccf2e1ce954d8cdb4890fac72d04864

Database specific

{
    "cpe": "cpe:2.3:a:eclipse:threadx_usbx:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.3.0"
        }
    ]
}

Affected versions

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48696.json"