Threadx Usbx
Monthly
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition. [CVSS 4.2 MEDIUM]
Out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 allows an attacker with physical access to a target device to leak a small amount of host memory by attaching a crafted USB peripheral; the vulnerable code is _ux_host_class_audio10_sam_parse_func(), which parses a malicious USB Audio Class 1.0 sampling-frequency list. Impact is constrained - CVSS 2.4, assessed as CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - because the attacker must be physically present, the host must be built with the USB Audio Class 1.0 host class driver enabled, and exploitation requires the device to be plugged in/enumerated, yielding only low-confidentiality information disclosure with no integrity or availability effect. Publicly available exploit code exists, and EPSS is low (0.56%, 45th percentile), indicating a low real-world priority; no evidence of active exploitation was identified.
An out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 allows an attacker with physical access to a USB host port to drive the host audio class descriptor parser past its buffer bounds by plugging in a crafted USB device. The flaw is in _ux_host_class_audio_alternate_setting_locate(), which indexes frequency fields taken from an attacker-controlled descriptor, and publicly available exploit code exists for it. Real-world priority is low: EPSS is 0.38% (30th percentile), the CVSS 4.0 base score is 2.4 with an attack vector of physical (AV:P), the CVSS vector shows PR:N (no privileges required once the device is connected), and the assessed impact is limited to a low integrity effect with no scored confidentiality or availability loss.
An out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 occurs when a device acting as a USB host enumerates an attacker-supplied USB audio class device and _ux_host_class_audio_device_type_get() parses a malformed audio descriptor. Exploitation requires physical access to a USB port (AV:P) and high complexity to craft a descriptor that reliably triggers the over-read, and impact is bounded to low integrity and availability with no confidentiality loss; publicly available exploit code exists, but the EPSS score of 0.33% (23rd percentile) and the assessed vector confirm this is not remotely exploitable and is a low-priority issue.
An out-of-bounds read in Eclipse Foundation's USBX USB host stack (before 6.4.3) is reachable when the audio class driver parses the streaming sampling descriptor of a connected USB audio device, allowing an attacker with physical hardware access to fault or crash the stack. Because triggering the bug requires hands-on connection of a malicious or malformed USB streaming device during enumeration (CVSS 4.0 base 2.4 with AV:P, and our independent assessment of CVSS:3.1/AV:P/AC:L/PR:N/UI:N/A:L), exploitation is neither remote nor network-based and is limited to a denial-of-service/availability effect with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.27% (18th percentile), consistent with a low-priority, physically-gated flaw.
An out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 can expose a limited amount of adjacent memory when the USB host stack parses a malformed HID report descriptor supplied by an attached USB device, with the flaw residing in _ux_host_class_hid_report_descriptor_get(). Only targets running USBX in USB-host mode with the HID class driver enabled are affected, and an attacker must have physical or local access to connect a crafted or malicious HID device, so the exposure is a bounded information-disclosure rather than code execution or denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS is negligible at 0.17% (5th percentile), consistent with the assessed severity of CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX-supported processors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition. [CVSS 4.2 MEDIUM]
Out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 allows an attacker with physical access to a target device to leak a small amount of host memory by attaching a crafted USB peripheral; the vulnerable code is _ux_host_class_audio10_sam_parse_func(), which parses a malicious USB Audio Class 1.0 sampling-frequency list. Impact is constrained - CVSS 2.4, assessed as CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - because the attacker must be physically present, the host must be built with the USB Audio Class 1.0 host class driver enabled, and exploitation requires the device to be plugged in/enumerated, yielding only low-confidentiality information disclosure with no integrity or availability effect. Publicly available exploit code exists, and EPSS is low (0.56%, 45th percentile), indicating a low real-world priority; no evidence of active exploitation was identified.
An out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 allows an attacker with physical access to a USB host port to drive the host audio class descriptor parser past its buffer bounds by plugging in a crafted USB device. The flaw is in _ux_host_class_audio_alternate_setting_locate(), which indexes frequency fields taken from an attacker-controlled descriptor, and publicly available exploit code exists for it. Real-world priority is low: EPSS is 0.38% (30th percentile), the CVSS 4.0 base score is 2.4 with an attack vector of physical (AV:P), the CVSS vector shows PR:N (no privileges required once the device is connected), and the assessed impact is limited to a low integrity effect with no scored confidentiality or availability loss.
An out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 occurs when a device acting as a USB host enumerates an attacker-supplied USB audio class device and _ux_host_class_audio_device_type_get() parses a malformed audio descriptor. Exploitation requires physical access to a USB port (AV:P) and high complexity to craft a descriptor that reliably triggers the over-read, and impact is bounded to low integrity and availability with no confidentiality loss; publicly available exploit code exists, but the EPSS score of 0.33% (23rd percentile) and the assessed vector confirm this is not remotely exploitable and is a low-priority issue.
An out-of-bounds read in Eclipse Foundation's USBX USB host stack (before 6.4.3) is reachable when the audio class driver parses the streaming sampling descriptor of a connected USB audio device, allowing an attacker with physical hardware access to fault or crash the stack. Because triggering the bug requires hands-on connection of a malicious or malformed USB streaming device during enumeration (CVSS 4.0 base 2.4 with AV:P, and our independent assessment of CVSS:3.1/AV:P/AC:L/PR:N/UI:N/A:L), exploitation is neither remote nor network-based and is limited to a denial-of-service/availability effect with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.27% (18th percentile), consistent with a low-priority, physically-gated flaw.
An out-of-bounds read in Eclipse ThreadX USBX before 6.4.3 can expose a limited amount of adjacent memory when the USB host stack parses a malformed HID report descriptor supplied by an attached USB device, with the flaw residing in _ux_host_class_hid_report_descriptor_get(). Only targets running USBX in USB-host mode with the HID class driver enabled are affected, and an attacker must have physical or local access to connect a crafted or malicious HID device, so the exposure is a bounded information-disclosure rather than code execution or denial of service. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS is negligible at 0.17% (5th percentile), consistent with the assessed severity of CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX-supported processors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.