Read the docs
TI-2023-26533 Aliases CVE-2023-48694

Azure RTOS USBX Remote Code Execution Vulnerability

Priority MEDIUM 46CWE-825Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to expired pointer dereference and type confusion vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host stack and host class, related to device linked classes, ASIX, Prolific, SWAR, audio, CDC ECM in RTOS v6.2.1 and below. The fixes have been included in USBX release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01332 71st percentileScored 2026-11-07
Fix Fixed usbx (azure-rtos): 6.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
azure-rtosusbxbefore 6.3.06.3.0Patch availableCNA
  • usbx Vendorazure-rtos Affected before 6.3.0 Fixed in 6.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:threadx_usbx:*:*:*:*:*:*:*:*before 6.3.0VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:threadx_usbx:*:*:*:*:*:*:*:* Versions before 6.3.0 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA usbx (azure-rtos) Fixed in 6.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48694

References

Advisory 1

  • TI-2022-16486 USBX Host CDC ECM integer underflow with buffer overflow CVSS 3.1CRITICAL 9.8
  • TI-2022-11787 Potential buffer overflow in function DFU upload in Azure RTOS USBX CVSS 3.1CRITICAL 9.8
  • TI-2022-11766 Buffer overflow on HUB descriptor in Azure RTOS USBX CVSS 3.1CRITICAL 9.8
  • TI-2022-18669 Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflow CVSS 3.1CRITICAL 9.8
  • TI-2023-26537 Azure RTOS USBX Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-26536 Azure RTOS USBX Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences