CVE-2022-23748 in audinate dante application library
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.
Affected software: audinate dante application library
Scores
- CVSS: 7.8 (high)
- EPSS: 8.33% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2025-02-06
- Published: 2022-11-17
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Remove Dante Discovery and use Dante Controller (CVE-2022-23748)
Workaround. mDNSResponder.exe from Audinate Dante Discovery can be abused for DLL sideloading, which threat actors used to load malware. Audinate advises to uninstall Dante Discovery, which is no longer maintained, and use Dante Controller.
Applies to: Windows hosts with Audinate Dante Discovery installed.
- Find hosts with Dante Discovery installed (Apps and Features or a software inventory).
- Uninstall Dante Discovery.
- Install the current Dante Controller if the host still needs to see Dante devices.
- Check the install folder for unexpected DLLs next to mDNSResponder.exe before removal.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.