Dante Discovery CVE-2022-23748: DLL Sideloading in KEV
This is a local DLL sideloading bug that attackers used as a malware loader by bringing their own copy of the signed executable, so patching changes little; update Dante-based apps when convenient and make sure your endpoint tooling flags the pattern.
Must act: Windows fleets running third-party audio or conferencing software built on the Dante Application Library for Windows 1.2.0 or earlier, and defenders who hunt for signed-binary abuse.
Can relax: Everyone else; the flaw is not remotely exploitable and Audinate says it does not affect other Dante hardware or software that ships an mDNSResponder.exe.
- Ask the vendors of any Windows audio, AV or conferencing software that uses the Dante Application Library whether their build ships mDNSResponder.exe 1.3.2 or later, and install their update.
- Search Windows endpoints for mDNSResponder.exe outside the install folders you expect, especially in user-writable paths.
- Alert on any file named dal_keepalives.dll and on signed binaries that run from user profile, temp or ProgramData folders.