CVE-2022-23748 Dante Discovery Process Control

CVE-2022-23748 is a critical security vulnerability identified in the mDNSResponder.exe component of Audinate’s Dante Application Library for Windows versions 1.2.0 and earlier. This flaw allows for a DLL sideloading attack, where the executable improperly specifies how to load DLLs, enabling attackers to execute malicious code by exploiting the legitimate executable.

What is Vulnerable to CVE-2022-23748

The vulnerability specifically affects systems running the Dante Application Library for Windows versions 1.2.0 and earlier. Third-party products that utilize this library are also at risk. Notably, the mDNSResponder.exe component is susceptible to this DLL sideloading attack.

Mitigation and Remediation for CVE-2022-23748

To address this vulnerability, the following steps are recommended:

1. Update the Software: Audinate has released an updated version of the Dante Application Library for Windows (v1.2.1) that includes a patched mDNSResponder.exe (v1.3.2). Users should update to this version or apply the standalone security patch provided for versions 1.2.0 and earlier.

   getdante.com

2. Contact Third-Party Vendors: If you are using software that incorporates the Dante Application Library, reach out to the respective vendors to obtain the latest updates addressing this vulnerability.

3. Implement Security Best Practices:

   • Restrict user permissions to minimize the risk of unauthorized code execution.
   • Regularly monitor systems for unusual activities or unauthorized access attempts.
   • Educate users about the dangers of executing untrusted files and the importance of maintaining updated software.

Impact of Successful Exploitation of CVE-2022-23748

Exploiting this vulnerability allows attackers to execute arbitrary code with the same privileges as the mDNSResponder.exe process. This can lead to unauthorized access, data manipulation, and potential system disruptions. The attack requires local access and user interaction, which limits its scope but still poses a significant threat if exploited.

Proof of Concept for CVE-2022-23748

As of now, there is no publicly available proof-of-concept exploit for CVE-2022-23748. However, the vulnerability has been actively exploited in the wild, prompting its inclusion in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities Catalog.

Organizations are strongly advised to apply the recommended updates and follow best practices to mitigate the risks associated with this vulnerability.