CVE-2022-24705

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
https://accel-ppp.org/accel-ppp>= 1.12, <= 1.12

References

Timeline

Published
Feb 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-247069.8In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin prCVE-2022-247078.8Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injectionCVE-2022-247085.4Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior toCVE-2022-247096.1@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface CVE-2022-24719.8Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DBCVE-2022-247105.4Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used iCVE-2022-247119.8CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerabCVE-2022-247128.8CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remoteCVE-2022-247137.5regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of CVE-2022-247145.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writerCVE-2022-247158.8Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the confiCVE-2022-247167.5Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents o
CVE-2022-24705: Critical severity, CVSS 9.8 | Vulnix