CVE-2022-30065

Published: May 18, 2022Modified: Jul 7, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

Affected (7)

Products: Busybox: Busybox · Siemens: Scalance Sc622 2c Firmware, Scalance Sc626 2c Firmware, Scalance Sc632 2c Firmware, Scalance Sc636 2c Firmware, Scalance Sc642 2c Firmware, Scalance Sc646 2c Firmware

Busybox

1 product

Busybox

Siemens

6 products

Scalance Sc622 2c Firmware

Scalance Sc626 2c Firmware

Scalance Sc632 2c Firmware

Scalance Sc636 2c Firmware

Scalance Sc642 2c Firmware

Scalance Sc646 2c Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Busybox Busybox	Version 1.35.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Sc622 2c Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Scalance Sc622 2c	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Sc626 2c Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Scalance Sc626 2c	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Sc632 2c Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Scalance Sc632 2c	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Sc636 2c Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Scalance Sc636 2c	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Sc642 2c Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Scalance Sc642 2c	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Sc646 2c Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Scalance Sc646 2c	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (4)

https://bugs.busybox.net/show_bug.cgi?id=14781

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf

Source: cve@mitre.org

Third Party Advisory

https://bugs.busybox.net/show_bug.cgi?id=14781

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.