Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-28391

29
FAUCET Score

CVE-2022-28391 is a high-severity vulnerability affecting BusyBox versions up to 1.35.0, where remote attackers can execute arbitrary code or manipulate terminal colors. This occurs when the 'netstat' utility is used to display a crafted DNS PTR record on a VT-compatible terminal. With a CVSS score of 8.8, this vulnerability has a network attack vector, low complexity, and can lead to high impact on confidentiality, integrity, and availability, requiring user interaction. While no public exploits or Metasploit modules are currently available, and it is not listed in CISA's KEV catalog, there has been some community discussion, indicating awareness of the issue.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.35.0CPE matchmatch criteria
cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.49%
Probability of exploitation in next 30 days
EPSS Percentile
87.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0349 is in the 87th percentile among its peer group of 14,848 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (40)

microsoftpatch availablevia msrc
Product: 19943-17084Fixed in: 1.36.1-3
microsoftpatch availablevia msrc
Product: 18755-17084Fixed in: 1.36.1-3
microsoftpatch availablevia msrc
Product: 18753-16820Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 18754-16823Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16490-12137Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 16491-12137Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 16492-12137Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 16493-12138Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 16494-12138Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 16495-12138Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: 16496-12139Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16497-12139Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16498-12139Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16499-12140Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16500-12140Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16501-12140Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: 16502-12356Fixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: 16503-12356Fixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: 16504-12357Fixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: 16505-12357Fixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: azl3 busybox 1.36.1-12 on Azure Linux 3.0Fixed in: 1.36.1-3
microsoftpatch availablevia msrc
Product: azl3 busybox 1.36.1-3 on Azure Linux 3.0Fixed in: 1.36.1-3
microsoftpatch availablevia msrc
Product: cm1 busybox 1.34.1-2 on CBL Mariner 1.0Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: cbl2 busybox 1.35.0-2 on CBL Mariner 2.0Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-1.34.1-2.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: busybox-petitboot-1.34.1-2.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: busybox-debuginfo-1.34.1-2.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: busybox-1.34.1-2.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: busybox-petitboot-1.34.1-2.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: busybox-debuginfo-1.34.1-2.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 1.34.1-2
microsoftpatch availablevia msrc
Product: busybox-1.35.0-2.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-petitboot-1.35.0-2.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-debuginfo-1.35.0-2.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-1.35.0-2.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-petitboot-1.35.0-2.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-debuginfo-1.35.0-2.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 1.35.0-2
microsoftpatch availablevia msrc
Product: busybox-1.36.1-5.azl3.x86_64.rpm on Azure Linux 3.0 x64Fixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: busybox-petitboot-1.36.1-5.azl3.x86_64.rpm on Azure Linux 3.0 x64Fixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: busybox-1.36.1-5.azl3.aarch64.rpm on Azure Linux 3.0 ARMFixed in: 1.36.1-5
microsoftpatch availablevia msrc
Product: busybox-petitboot-1.36.1-5.azl3.aarch64.rpm on Azure Linux 3.0 ARMFixed in: 1.36.1-5

Vendor Advisories (3)

microsoft2024-Jun/CVE-2022-28391

CVE-2022-28391

Jun 11, 2024
microsoft2022-Apr/CVE-2022-28391Important

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively the attacker could choose to change the terminal's colors.

Apr 12, 2022
redhatCVE-2022-28391Moderate

busybox: remote attackers may execute arbitrary code if netstat is used

Apr 3, 2022

References

git.alpinelinux.org / aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
Mailing ListPatchVendor Advisory
git.alpinelinux.org / aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch
Mailing ListPatchVendor Advisory
gitlab.alpinelinux.org / alpine/aports/-/issues/13661
ExploitPatchVendor Advisory