CVE-2023-48692

The vulnerabilities (CWE-787: out-of-bounds write, CWE-825: expired pointer dereference) occur in components handling network protocols: ICMP, TCP, SNMP, DHCP, NAT, and FTP. An attacker can send specially crafted network packets that cause buffer overflow beyond its boundaries or access to incorrect memory areas. The result is the ability to take control of code execution flow on the target device without any user interaction and without prior authentication.

An attacker can remotely execute arbitrary code (RCE) on a vulnerable device, which in practice means complete takeover of an embedded system or IoT device, including the ability to compromise confidentiality, integrity, and availability of data and device functions.

Azure RTOS NetX Duo should be updated to version 6.3.0 or later, which includes the fixes. The manufacturer does not indicate any alternative workarounds — updating is the only recommended action.

Azure RTOS NetX Duo version 6.2.1 and earlier — components handling ICMP, TCP, SNMP, DHCP, NAT, and FTP protocols