DLL Sideloading Vulnerability in Audinate Dante Discovery

Historical catalog analysis: CISA added this entry on February 06, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2022-23748 is a process control vulnerability (CWE-114) identified in the mDNSResponder.exe component of Audinate Dante Discovery. The flaw allows for a DLL sideloading attack, where a local attacker can leverage the Dante Application Library to execute arbitrary code on the affected system.

Exposure and applicability

This vulnerability applies to environments utilizing Audinate Dante Discovery, which is frequently deployed in AV-over-IP networking. In industrial contexts, this technology is often integrated into building automation systems, large-scale facility operations, and operational communication infrastructure where networked audio and control are required.

Because the attack vector is classified as local, an attacker would require prior access to the system hosting the Dante Discovery software to exploit the vulnerability. This makes the risk highest for engineering workstations or management servers that have been compromised via other means or are accessible to unauthorized personnel.

Remediation priorities

Based on our analysis of the reported flaw, OT security leaders and building automation engineers should prioritize the following actions:

1. Inventory and Version Audit: Identify all systems running Audinate Dante Discovery. Since this is a local attack vector, priority should be given to systems with broader access or those residing on shared management networks.
2. Vendor Mitigation Application: Apply mitigations as specified in the official vendor instructions. If the vendor has provided an updated version of the software or specific configuration changes to prevent DLL sideloading, these should be implemented following standard OT change control processes.
3. Product Evaluation: In cases where mitigations are unavailable or cannot be applied due to operational constraints, evaluate whether the product can be discontinued without impacting critical facility operations.
4. Access Control Hardening: Since the vulnerability requires local access, restricting administrative privileges and limiting physical and logical access to workstations running this software could reduce the likelihood of exploitation.

How to validate remediation

To verify that exposure has been reduced, administrators should:
* Confirm the installation of vendor-recommended patches or configuration changes via version checks or system audits.
* Verify through system logs or file integrity monitoring that unauthorized DLLs are not present in the directories associated with mDNSResponder.exe.
* Ensure that the principle of least privilege is applied to the accounts used to operate Dante Discovery software, limiting the ability of a local user to place malicious files in application paths.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in active ransomware campaigns. Additionally, while CISA has mandated a remediation deadline of February 27, 2025, for covered federal agencies, this date is not a universal requirement for private sector asset owners, though it serves as a benchmark for urgency.

Users should note that applying patches to OT-adjacent software requires careful coordination to ensure that communication between AV-over-IP devices and control systems is not interrupted. A version check alone does not guarantee security against all local attack vectors; it only confirms the application of known vendor fixes.

Source and editorial note

CVE-2022-23748: Dante Discovery Process Control Vulnerability · Source date: February 06, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 09, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 21, 2026 at 01:47 UTC.

Request an OT security assessment