CVE-2022-23748

What it actually does

This vulnerability is a Windows DLL sideloading flaw in mDNSResponder.exe as distributed with Audinate Dante Application Library components. The executable does not safely constrain where it loads required DLLs from, allowing a malicious DLL placed in a searched directory to be loaded by the legitimate signed process. If the vulnerable binary is launched by a user or service with elevated privileges, attacker-controlled code executes with that same privilege level, enabling privilege escalation, persistence, credential access, defense evasion, or lateral movement staging.

Why it matters to the business

Successful exploitation can turn a trusted multimedia/network discovery component into a vehicle for running attacker code, potentially giving an intruder control of affected Windows systems. Because this issue is listed in CISA KEV, has active in-the-wild exploitation, and has a CISA remediation due date of 2025-02-27, organizations using affected Dante-related software should treat it as a high-priority operational risk even though exploitation requires local execution or user interaction. Compromise of systems used for audio, conferencing, production, broadcast, or facility operations may disrupt business workflows and can provide a foothold into broader Windows environments.

How an attack unfolds

An attacker first obtains local execution capability on a Windows system or convinces a user to run or open content that causes the vulnerable mDNSResponder.exe to execute. The attacker places a malicious DLL where Windows DLL search order allows the vulnerable executable to find it before the legitimate library. When mDNSResponder.exe starts, it loads the attacker-controlled DLL as though it were a normal dependency. The malicious DLL then runs inside the trusted process context. If that process is executed by a privileged user or service, the attacker gains elevated code execution. From there, the attacker may launch shell commands, install persistence, dump credentials, disable security tooling, or use the host as a staging point. Active exploitation has been reported and the issue is tracked in CISA KEV; the supplied threat context references “Dante Discovery Process Control Vulnerability,” so hunting should focus on abuse of Dante or mDNSResponder process execution and suspicious DLL loads.

How to fix it

Apply vendor-provided updates for affected Audinate Dante Application Library or applications that bundle the vulnerable mDNSResponder.exe. No exact fixed versions were provided in the input, so confirm remediation through the relevant vendor advisories and update all software packages that include the vulnerable component. Where immediate patching is not possible, remove unused Dante/Bonjour/mDNSResponder components, restrict write permissions to application installation directories, block execution from user-writable locations, and use Windows Defender Application Control or AppLocker to prevent unsigned or untrusted DLLs from loading. Ensure standard users cannot write into directories containing trusted executables. Monitor or block suspicious child processes spawned by mDNSResponder.exe. Because this is in CISA KEV, prioritize remediation before or in line with the 2025-02-27 due date for covered organizations.

How to confirm the fix worked

Confirm that affected Dante-related software has been upgraded to a vendor-fixed release or removed if not required. Inventory Windows systems for mDNSResponder.exe instances and verify their file paths, publisher signatures, and product versions. Check that the executable resides in an expected vendor installation directory and that the directory is not writable by non-administrators. Validate that no unexpected DLLs exist beside the executable or in its working directory. Use EDR or Sysmon to confirm that mDNSResponder.exe loads DLLs only from trusted vendor or Windows directories. Test application functionality after patching and verify that no compatibility workaround reintroduced insecure DLL search behavior.

Typical attack path

1. Identify a Windows host with affected Dante Application Library or related mDNSResponder.exe components installed.
2. Gain local file placement or local execution opportunity through phishing, prior malware, removable media, software deployment abuse, or another foothold.
3. Place a malicious DLL in a directory searched by mDNSResponder.exe before the legitimate DLL location.
4. Trigger execution of mDNSResponder.exe directly, through a shortcut, application launch, service start, scheduled task, or user interaction.
5. The vulnerable executable loads the malicious DLL because of unsafe DLL search behavior.
6. Attacker code executes in the context of mDNSResponder.exe, potentially with elevated privileges.
7. Use the gained execution context to establish persistence, run post-exploitation tools, access credentials, or move laterally.

How to detect it

To determine whether this was already exploited, review endpoint telemetry for mDNSResponder.exe process starts, DLL module loads, file creation events, and child processes. Useful sources include EDR process/module telemetry, Sysmon Event ID 1 for process creation, Sysmon Event ID 7 for image loads if enabled, Sysmon Event ID 11 for file creation, Windows Security Event ID 4688 for process creation, Service Control Manager Event ID 7045 for new services, PowerShell logs, and antivirus quarantine records. Look for mDNSResponder.exe loading DLLs from the same application directory when those DLLs are unsigned, recently created, have unusual hashes, or are writable by non-administrators. Investigate mDNSResponder.exe launching cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, curl.exe, or other post-exploitation tooling. Check for recent DLL writes in Dante, Bonjour, or application bundle directories preceding mDNSResponder.exe execution. Correlate with logons from unusual users, privilege escalation events, new scheduled tasks, new services, and outbound network connections from mDNSResponder.exe to non-local or unexpected destinations.

• mDNSResponder.exe
• \mDNSResponder.exe
• mDNSResponder.exe cmd.exe
• mDNSResponder.exe powershell.exe
• mDNSResponder.exe rundll32.exe
• mDNSResponder.exe regsvr32.exe
• mDNSResponder.exe mshta.exe
• mDNSResponder.exe wscript.exe
• mDNSResponder.exe cscript.exe
• mDNSResponder.exe certutil.exe
• mDNSResponder.exe bitsadmin.exe
• mDNSResponder.exe curl.exe
• ImageLoaded=*\mDNSResponder.exe*
• ParentImage=*\mDNSResponder.exe*
• Image=mDNSResponder.exe
• OriginalFileName=mDNSResponder.exe
• C:\Program Files\Audinate\
• C:\Program Files (x86)\Audinate\
• C:\Program Files\Bonjour\mDNSResponder.exe
• C:\Program Files (x86)\Bonjour\mDNSResponder.exe

What your security team should do

• Prioritize patching or removing affected Dante Application Library components because the vulnerability is in CISA KEV and exploitation is active in the wild.
• Inventory all Windows endpoints and servers for mDNSResponder.exe and Dante-related software, including software bundled inside audio, conferencing, broadcast, or production tools.
• Hunt for suspicious DLL loads by mDNSResponder.exe, especially unsigned DLLs, recently created DLLs, or DLLs loaded from user-writable directories.
• Review EDR telemetry for mDNSResponder.exe spawning command shells, scripting engines, LOLBins, credential tools, or unexpected network connections.
• Harden application directories so standard users cannot create or modify DLLs next to trusted executables.
• Deploy application control rules to block untrusted DLLs and prevent execution from temporary, downloads, profile, and other user-writable paths.
• If exploitation is suspected, isolate the host, collect volatile process and module evidence, preserve suspicious DLLs for malware analysis, and rotate credentials used on the system.