Audinate Dante Discovery DLL Sideloading Vulnerability

Historical catalog analysis: CISA added this entry on February 06, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2022-23748 is a process control vulnerability (CWE-114) located within the mDNSResponder.exe component of Audinate Dante Discovery. The flaw allows for a DLL sideloading attack, where a local attacker can leverage the Dante Application Library to execute arbitrary code on the affected system.

Exposure and applicability

This vulnerability applies to environments utilizing Audinate Dante Discovery. Because the attack vector is local, exposure is highest in scenarios where an attacker has already gained initial access to the workstation or where untrusted users have write permissions to directories used by the mDNSResponder.exe process. Infrastructure owners managing professional audio-over-IP networks should identify all endpoints running this specific software to determine their risk surface.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize the following actions:

1. Asset Identification: Locate all instances of Audinate Dante Discovery across the network to establish a baseline of affected systems.
2. Vendor Mitigation Application: Apply the specific mitigations provided by Audinate. If these mitigations cannot be applied or are unavailable for a specific deployment, our analysis suggests discontinuing use of the product to eliminate the attack vector.
3. Privilege Review: Evaluate local directory permissions on affected hosts to ensure that non-administrative users cannot place malicious DLLs in paths searched by mDNSResponder.exe.

How to validate remediation

Verification must go beyond a simple version check, as the goal is to ensure the sideloading path is no longer viable. Defenders should:
* Verify Mitigation Deployment: Confirm that the specific vendor-recommended configuration changes or patches have been applied to the mDNSResponder.exe environment.
* Configuration Audit: Use authorized system auditing tools to verify that the application’s search order for dependencies does not include writable, non-privileged directories.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while vendor mitigations are available, there is residual risk if local administrative privileges are compromised, as an attacker with high-level access may be able to bypass certain process controls. The effectiveness of the remediation depends entirely on the strict adherence to the vendor’s specific technical instructions.

Source and editorial note

CVE-2022-23748: Dante Discovery Process Control Vulnerability · Source date: February 06, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 09, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 25, 2026 at 00:57 UTC.

Request a Vulnerability Assessment