CVE-2022-30065
HIGH
Published May 18, 20224y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
Published May 18, 2022 4y ago
Last Modified Jun 17, 2026 2w ago
Description
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-416 Use After Free Memory Safety
Affected Products 13
| Vendor | Product | Version | Range |
|---|---|---|---|
| busybox | busybox | 1.35.0 | any |
| siemens | scalance_sc622-2c_firmware | * | <3.0 |
| siemens | scalance_sc622-2c | * | any |
| siemens | scalance_sc626-2c_firmware | * | <3.0 |
| siemens | scalance_sc626-2c | * | any |
| siemens | scalance_sc632-2c_firmware | * | <3.0 |
| siemens | scalance_sc632-2c | * | any |
| siemens | scalance_sc636-2c_firmware | * | <3.0 |
| siemens | scalance_sc636-2c | * | any |
| siemens | scalance_sc642-2c_firmware | * | <3.0 |
| siemens | scalance_sc642-2c | * | any |
| siemens | scalance_sc646-2c_firmware | * | <3.0 |
| siemens | scalance_sc646-2c | * | any |
References 2
- bugs.busybox.net https://bugs.busybox.net/show_bug.cgi?id=14781
- cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.