by Kastro
Paper/Archive/CVE-2022-48174

CVE-2022-48174

Siemens RUGGEDCOM RST2428P — There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35.

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.0.880 × 2017.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
RUGGEDCOM RST2428P< V3.3V3.3siemens-SADP
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family< V3.3V3.3siemens-SADP
SCALANCE XCH328< V3.3V3.3siemens-SADP
SCALANCE XCM324< V3.3V3.3siemens-SADP
SCALANCE XCM328< V3.3V3.3siemens-SADP
SCALANCE XCM332< V3.3V3.3siemens-SADP
SCALANCE XRH334 (24 V DC, 8xFO, CC)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (230 V AC, 12xFO)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (230 V AC, 8xFO)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (24 V DC, 12xFO)< V3.3V3.3siemens-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugs.busybox.net/show_bug.cgi?id=15216refsecurity.netapp.com/advisory/ntap-20241129-0001reflists.debian.org/debian-lts-announce/2025/01/msg00012.htmlrefcert-portal.siemens.com/productcert/html/ssa-089022.htmlrefcert-portal.siemens.com/productcert/html/ssa-585531.html