Is CVE-2023-48691 actively exploited?

No active exploitation of CVE-2023-48691 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-48691 be exploited remotely?

Yes. CVE-2023-48691 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-48691?

CVE-2023-48691 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-48691

CRITICAL

CVE-2023-48691

CWE-787Published: December 5, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause an out-of-bounds write in Azure RTOS NETX Duo, that could lead to remote code execution. The affected components include process related to IGMP protocol in RTOS v6.2.1 and below. The fix has been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

NVD Source

Risk Analysis

An out-of-bounds write vulnerability in the IGMP protocol implementation of Azure RTOS NetX Duo can lead to remote code execution. The 9.8 CVSS score marks this as a critical security issue.

There is no known public exploit for this vulnerability, and it is not in the KEV catalog. It is remotely exploitable with low complexity.

Recommended Action

Upgrade to NetX Duo release 6.3.0, as there are no known workarounds.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-48691 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.