CVE-2022-23748
Dante Discovery Process Control Vulnerability
Description
CVE-2022-23748 is a high-severity DLL sideloading vulnerability in Audinate Dante Discovery, specifically in the mDNSResponder.exe component. The executable improperly specifies how it loads DLL files, allowing a malicious attacker to place a crafted DLL in a location where mDNSResponder.exe will load it instead of the legitimate library. With a CVSS v3.1 base score of 7.8 and an EPSS score of 11.74% at the 93rd percentile, this vulnerability enables arbitrary code execution in the context of the trusted Dante Discovery process. CISA has added CVE-2022-23748 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| audinate | dante application library | <= 1.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://cpr-zero.checkpoint.com/vulns/cprid-2193/%2C(Broken Link)
- https://www.audinate.com/learning/faqs/audinate-response-to-dante-discovery-mdnsresponder-exe-security-issue-cve-2022-23748(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23748(US Government Resource)
Weakness Type
DLL Sideloading (Unsafe DLL Loading)
CVE-2022-23748 is a DLL sideloading vulnerability in the mDNSResponder.exe component of Audinate Dante Discovery. While no specific CWE has been formally assigned, the vulnerability is characteristic of DLL search order hijacking and unsafe library loading weaknesses. The mDNSResponder.exe executable fails to specify the complete, absolute path to required DLL files and does not validate the integrity of loaded libraries. This allows an attacker to place a malicious DLL with an expected filename in a directory that is searched before the legitimate DLL location, causing the trusted executable to load and execute the attacker's code.
Impact Analysis
CVE-2022-23748 poses a significant threat to organizations using Audinate Dante audio networking products, which are widely deployed in professional audio/video environments including broadcast studios, live event venues, corporate AV systems, and houses of worship. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the vulnerability requires local access and user interaction (such as opening a file or navigating to a directory containing the malicious DLL), but no authentication is needed. Confidentiality (High): Code execution within the Dante Discovery process provides access to the audio network configuration, device credentials, network topology, and any data accessible to the user running the application. In professional AV environments, this may include sensitive broadcast content, corporate communications, and production data. Integrity (High): Arbitrary code execution allows the attacker to modify Dante network configurations, redirect audio streams, install persistent malware, alter system files, and use the compromised system as a pivot point for further attacks within the network. Availability (High): The attacker can disrupt Dante audio networking operations by crashing the discovery service, corrupting configurations, or disabling audio routing — which can be critical during live events or broadcast operations. The EPSS score of 11.74% at the 93rd percentile indicates elevated exploitation activity. Ransomware association is currently listed as unknown, but DLL sideloading is a common technique used by advanced persistent threat groups and ransomware operators for defense evasion and persistence.
Exploit Maturity
CVE-2022-23748 demonstrates notable exploit maturity with confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming that threat actors are actively exploiting the DLL sideloading flaw in Dante Discovery's mDNSResponder.exe, with a mandatory remediation deadline of February 27, 2025. The EPSS score of 11.74% at the 93rd percentile indicates significantly elevated exploitation probability. DLL sideloading is a well-established attack technique (MITRE ATT&CK T1574.002) favored by both nation-state actors and financially motivated groups because it allows malicious code to execute within the context of a trusted, signed application, effectively bypassing application whitelisting and security controls. The vulnerability was originally reported by Check Point Research and Audinate has published a response and advisory addressing the issue. Ransomware association is currently listed as unknown.
Remediation
-
Update Audinate Dante Discovery and Dante Application Library. Upgrade to the latest version of Dante Discovery that addresses the DLL sideloading vulnerability. The vulnerability affects Dante Application Library versions 1.2.0 and earlier. Consult the Audinate security advisory for specific patched versions and download links. Update all systems running any Audinate Dante software that includes the mDNSResponder.exe component.
-
Restrict file system permissions on Dante installation directories. Ensure that the directories containing mDNSResponder.exe and its associated DLLs are protected with strict file system permissions that prevent non-administrator users from writing files. Remove write access for standard users to the Dante application directories and any directories in the DLL search path.
-
Deploy application control and DLL integrity monitoring. Implement application control policies (such as Windows Defender Application Control or AppLocker) that restrict which DLLs can be loaded by mDNSResponder.exe. Enable DLL load monitoring through endpoint detection and response (EDR) solutions to detect attempts to sideload unauthorized DLLs into Dante processes.
-
Audit and secure the Dante audio network. Review the deployment of Dante networking equipment and software across the organization. Ensure that Dante-enabled systems are on isolated network segments where possible, and restrict access to systems running Dante Discovery to authorized personnel only. Remove Dante Discovery from systems where it is not actively needed.
-
Monitor for DLL sideloading indicators. Configure endpoint detection rules to alert on unsigned or unexpected DLLs being loaded by mDNSResponder.exe. Watch for anomalous process behavior from the Dante Discovery executable, such as unexpected network connections, child process creation, or file system modifications that would indicate a sideloaded malicious DLL is active.
Technical Details
CVE-2022-23748 is a DLL sideloading vulnerability in the mDNSResponder.exe component of Audinate Dante Discovery. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local access is required, no privileges are needed, but user interaction is required (the user must trigger execution of the vulnerable binary in a context where the malicious DLL is present). The impact is high across confidentiality, integrity, and availability. The technical root cause is that mDNSResponder.exe does not specify the full absolute path for one or more DLL dependencies when loading them at runtime. On Windows, when an application calls LoadLibrary() or similar functions with a relative DLL name, the operating system searches a series of directories in a defined order — including the application's current working directory and directories in the PATH environment variable. If an attacker can place a malicious DLL with the expected filename in a directory that is searched before the legitimate DLL location, the malicious DLL will be loaded and its DllMain function (or other exported functions) will be executed in the context of the trusted mDNSResponder.exe process. Because mDNSResponder.exe is a legitimate, potentially signed Audinate binary, the malicious code executes with the trust and permissions of the host process, effectively bypassing application whitelisting solutions, code signing verification, and user-level access controls. The vulnerability affects Audinate Dante Application Library version 1.2.0 and earlier, which includes the vulnerable mDNSResponder.exe component used by Dante Discovery for network device discovery via multicast DNS.
Frequently Asked Questions
Is CVE-2022-23748 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2022-23748 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025. The EPSS score of 11.74% at the 93rd percentile further confirms elevated exploitation activity, with DLL sideloading being a favored technique among advanced threat actors.
What is Audinate Dante Discovery?
Dante Discovery is a component of the Audinate Dante audio networking platform, which is the industry standard for professional audio-over-IP networking. It is used in broadcast studios, live events, corporate AV installations, and other professional audio environments. The mDNSResponder.exe component handles multicast DNS-based network device discovery.
How do I fix CVE-2022-23748?
Update the Audinate Dante Application Library to a version newer than 1.2.0 that addresses the DLL sideloading vulnerability. Consult the Audinate security advisory for the specific patched version. As interim mitigations, restrict write permissions on Dante installation directories and deploy application control policies to prevent unauthorized DLL loading.
What is DLL sideloading?
DLL sideloading is an attack technique where a malicious DLL file is placed in a location where a legitimate application will load it instead of the intended library. When the trusted application runs, it loads and executes the attacker's code. This technique is particularly dangerous because the malicious code runs within a trusted process, potentially bypassing security controls like application whitelisting and antivirus detection.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.