CVE-2022-30065

HighCVSS 7.8/10Last modified Jul 7, 2026

Description

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.busybox.net/show_bug.cgi?id=14781Exploit, Issue Tracking, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfThird Party Advisory
https://bugs.busybox.net/show_bug.cgi?id=14781Exploit, Issue Tracking, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdfThird Party Advisory

Timeline

Published: May 18, 2022
Last modified: Jul 7, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-300675.5GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memor CVE-2022-30078.1The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (CVE-2022-300725.4WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.CVE-2022-300735.4WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.CVE-2022-300758.8In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due CVE-2022-300765.3ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 thro CVE-2022-300788.8NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow CVE-2022-300798.8Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that cou CVE-2022-30088.8The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the inpu CVE-2022-300839.8EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code (remote)CVE-2022-30107.5The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an CVE-2022-301059.8In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exh