9.8

CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 11.0
Busybox ≫ Busybox Version <= 1.36.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.13% 0.864
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://bugs.busybox.net/show_bug.cgi?id=15216
Vendor Advisory
Issue Tracking
https://security.netapp.com/advisory/ntap-20241129-0001/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html
Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
https://cert-portal.siemens.com/productcert/html/ssa-585531.html