CVE-2023-48697

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in pictbridge and host class, related to PIMA, storage, CDC ACM, ECM, audio, hub in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476CWE-787CWE-825

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-486989.8Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker canCVE-2023-486999.8fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, anCVE-2023-48706.1A vulnerability classified as problematic has been found in SourceCodester Contact Manager App 1.0. This affects an unknown part of the fileCVE-2023-487006.5The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into NautobotCVE-2023-487016.1Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look liCVE-2023-487027.2Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrCVE-2023-487037.5RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This iCVE-2023-487047.5ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap CVE-2023-487055.4Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier thanCVE-2023-487064.7Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very fiCVE-2023-487076.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHACVE-2023-487086.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are rec
CVE-2023-48697: Critical severity, CVSS 9.8 | Vulnix