CVE-2022-23748: Dante Discovery Process Control Vulnerability

CVE-2022-23748 is a process control vulnerability in Audinate Dante Discovery that enables a local attacker to perform a DLL sideloading attack against mDNSResponder.exe. By leveraging this issue in the Dante Application Library, the attacker can execute arbitrary code on the system. This matters because Dante Discovery is commonly used in professional audio networking environments; successful abuse could allow a local threat actor to run code with the privileges of the affected process, potentially leading to further compromise of the host.

Public detail is limited to the CISA description of the flaw class and impact. Confirm exact product scope, fixed releases, and any additional technical notes against the vendor advisory before taking action.

How it works

The vulnerability is classified as CWE-114 (Process Control). In this class of issue, an application fails to properly control how external code modules (such as DLLs) are loaded into a process. Here, the affected component is mDNSResponder.exe within Dante Discovery / the Dante Application Library.

A local attacker who can place a malicious DLL in a location searched by the process can cause mDNSResponder.exe to load and execute that DLL instead of the legitimate library. This is a classic DLL sideloading technique. No remote exploitation path is described in the available facts; the attack requires local access or the ability to write to a directory that the process consults for libraries. Specifics of search-order hijacking or exact load paths must be confirmed against the vendor advisory; do not assume unstated mechanics.

Am I affected? How to find it in your systems

Audinate Dante Discovery is typically installed on Windows hosts that participate in Dante audio networks—workstations, servers, or dedicated audio appliances running Dante software or the Dante Application Library. Inventory systems that handle professional audio routing, live-sound consoles, broadcast facilities, or AV-over-IP infrastructure.

• Search installed software inventories, package managers, or endpoint management tools for “Dante,” “Audinate,” “Dante Discovery,” or “Dante Application Library.”
• Locate running instances of mDNSResponder.exe and note the parent process and installation path; these often indicate Dante-related components.
• Check configuration management databases or software bills of materials for any Audinate products. Because exact vulnerable versions are not provided in the available facts, compare every discovered installation against the vendor advisory to determine whether it is affected.
• Telemetry signs of exploitation are not detailed publicly. Look for unexpected DLL loads by mDNSResponder.exe, creation of unfamiliar DLLs in application directories, or anomalous child processes spawned from Dante-related binaries. Correlate with local privilege-escalation or post-exploitation activity.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation instructions for Dante Discovery as named in the official Audinate advisory. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• After installing the update, verify that the vulnerable mDNSResponder.exe / Dante Application Library components have been replaced and that the process no longer exhibits the process-control weakness.
• For this class of DLL-sideloading vulnerability, additional hardening includes ensuring application directories are writable only by administrators, removing unnecessary write permissions from users, and enabling Windows features that restrict DLL search order (for example, SafeDllSearchMode and CWDIllegalInDllSearch where applicable).
• Rebuild or re-image systems that may have been exposed while unpatched, and re-validate the software inventory afterward.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls appropriate to a local DLL-sideloading flaw.

• Segment Dante-enabled hosts onto isolated audio or AV networks so that local access is limited to authorized operators.
• Restrict write access to directories used by Dante Discovery and mDNSResponder.exe; remove write permissions for standard users and service accounts that do not require them.
• If the Dante Discovery feature or mDNSResponder component can be disabled without breaking required audio functionality, turn it off until a patched version is installed.
• Deploy application-control or allow-listing policies that prevent unauthorized DLLs from loading into mDNSResponder.exe.
• Increase monitoring: alert on new DLL files appearing in Dante installation paths, unexpected module loads, and process-creation events involving mDNSResponder.exe. Virtual patching via host-based controls can further constrain the process until the official fix is in place.

If your data may have been exposed

Actively exploited local code-execution vulnerabilities can be used as a foothold for broader compromise, including data theft or lateral movement. Known ransomware use of this specific CVE is not documented. If you suspect the vulnerability was leveraged, treat the host as potentially compromised: isolate it, preserve forensic evidence, and perform a full incident-response investigation. As a routine hygiene step, you can run a free exposure scan of organizational email addresses against known breach data sets to check whether credentials or other information have already appeared in public breach corpora.