GHSA-fwmg-rj6g-w99p: Azure RTOS NetX Duo Remote Code Execution Vulnerability

GHSA ID	GHSA‑fwmg‑rj6g‑w99p
CVE ID	CVE‑2023‑48691
Severity	High
CVSS score	8.1 (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`)
CWE	CWE-787
Published	2023‑12‑03
Last updated	2023‑12‑03

GHSA ID

GHSA‑fwmg‑rj6g‑w99p

CVE ID

CVE‑2023‑48691

Severity

High

CVSS score

8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CWE

CWE-787

Published

2023‑12‑03

Last updated

2023‑12‑03

Affected packages

Package	Vulnerable versions	Patched versions
NetX Duo	<6.3.0	6.3.0

Package

Vulnerable versions

Patched versions

NetX Duo

<6.3.0

6.3.0

Description

Impact An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution.

Affected Components The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0.

Remediation Upgrade to v6.3.0 or above.

For more information If you have any questions or comments about this advisory: • Open an issue in azure-rtos/netxduo • Post question on Microsoft Q&A