CVE-2022-28391
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to...
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
CVE-2022-28391- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-88
- Updated
- 2026-11-02
CVE List
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
CVE-2022-28391- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-02
EUVDEUVD-2022-32836
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
EUVD-2022-32836- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h8c3-8522-vxc6
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to...
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
GHSA-h8c3-8522-vxc6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-28391
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
ALPINE-CVE-2022-28391- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVAZL-41790
CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
AZL-41790- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
Show 10 moreShow less
OSVAZL-9311
CVE-2022-28391 affecting package busybox for versions less than 1.35.0-2
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
AZL-9311- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2022-28391
CVE-2022-28391 does not affect BellSoft software
- Record
BELL-CVE-2022-28391- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Record
CVE-2022-28391- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2022-1624
busybox security update
BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It provides replacements for most of the utilities you usually find in GNU fileutils, shellutils, etc. It provides a fairly complete environment for any small or embedded system.
Security Fix(es):
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record s value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal s colors.(CVE-2022-28391)
- Record
OESA-2022-1624- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2022-1650376937 No score
Fix of CVE: CVE-2022-28391
- CVE-2022-28391: fix possible terminal injection attacks from DNS query results
- Record
CLSA-2022-1650376937- Updated
- 2026-11-02
OSVCLSA-2022-1650377094 No score
Fixed CVE-2022-28391 in busybox
- CVE-2022-28391: fix possible terminal injection attacks from DNS query results
- Record
CLSA-2022-1650377094- Updated
- 2026-11-02
OSVCLSA-2022-1650377131 No score
Fix CVE(s): CVE-2022-28391
- SECURITY UPDATE: possible remote code execution
- debian/patches/CVE-2022-28391.patch: fix possible terminal injection attacks from DNS query results
- CVE-2022-28391
- Record
CLSA-2022-1650377131- Updated
- 2026-11-02
OSVCLSA-2023-1688070489 No score
Fix CVE(s): CVE-2022-28391
- SECURITY UPDATE: some applets are vulnerable to escape sequence
injection when used from an VT compatible terminal
- debian/patches/CVE-2022-28391.patch: sockaddr2str: ensure only printable characters are returned for the hostname part
- CVE-2022-28391
- Fix cpio.tests
- debian/patches/fix-cpio-tests.patch: set a correct owner
- Record
CLSA-2023-1688070489- Updated
- 2026-11-02
OSVCLSA-2025-1762269073 No score
Fix CVE(s): CVE-2018-1000500, CVE-2022-28391, CVE-2023-39810
- SECURITY UPDATE: missing SSL certificate validation vulnerability in wget
- debian/patches/CVE-2018-1000500-1.patch: implement TLS verification with CENABLE_FEATURE_WGET_OPENSSL
- debian/patches/CVE 2018-1000500-2.patch: fix openssl options for cert verification
- CVE-2018-1000500
- SECURITY UPDATE: escape sequence injection attack
- debian/patches/CVE-2022-28391-1.patch: sockaddr2str: ensure only printable characters are returned for the hostname part
- debian/patches/CVE-2022-28391-2.patch: nslookup: sanitize all printed strings
- CVE-2022-28391
- SECURITY UPDATE: directory traversal vulnerability in CPIO command
- debian/patches/CVE-2023-39810.patch: archival: disallow path traversals
- debian/config/pkg/*: regenerate to add the new FEATURE_PATH_TRAVERSAL_PROTECTION option
- CVE-2023-39810
- Record
CLSA-2025-1762269073- Updated
- 2026-11-02
OSVMGASA-2022-0135 No score
Updated busybox packages fix security vulnerability
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors. (CVE-2022-28391)
- Record
MGASA-2022-0135- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
busyboxAlpine:v3.12 |
before 1.31.1-r22 | 1.31.1-r22 |
busyboxAlpine:v3.13 |
before 1.32.1-r8 | 1.32.1-r8 |
busyboxAlpine:v3.14 |
before 1.33.1-r7 | 1.33.1-r7 |
busyboxAlpine:v3.15 |
before 1.34.1-r5 | 1.34.1-r5 |
busyboxAlpine:v3.16 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.17 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.18 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.19 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.20 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.21 |
before 1.35.0-r7 | 1.35.0-r7 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
busyboxAlpine:v3.22 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.23 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAlpine:v3.24 |
before 1.35.0-r7 | 1.35.0-r7 |
busyboxAzure Linux:3 |
before 1.36.1-3 | 1.36.1-3 |
busyboxAzure Linux:2 |
before 1.35.0-2 | 1.35.0-2 |
busyboxTuxCare:CentOS:6 |
before 1:1.15.1-21.el6_6.tuxcare.els1 | 1:1.15.1-21.el6_6.tuxcare.els1 |
busybox-petitbootTuxCare:CentOS:6 |
before 1:1.15.1-21.el6_6.tuxcare.els1 | 1:1.15.1-21.el6_6.tuxcare.els1 |
busyboxTuxCare:OracleLinux:6 |
before 1:1.15.1-21.el6_6.tuxcare.els1 | 1:1.15.1-21.el6_6.tuxcare.els1 |
busybox-petitbootTuxCare:OracleLinux:6 |
before 1:1.15.1-21.el6_6.tuxcare.els1 | 1:1.15.1-21.el6_6.tuxcare.els1 |
busyboxTuxCare:Ubuntu:16.04 |
before 2:1.22.0-15ubuntu1.4+tuxcare.els3 | 2:1.22.0-15ubuntu1.4+tuxcare.els3 |
busybox-initramfsTuxCare:Ubuntu:16.04 |
before 2:1.22.0-15ubuntu1.4+tuxcare.els3 | 2:1.22.0-15ubuntu1.4+tuxcare.els3 |
busybox-staticTuxCare:Ubuntu:16.04 |
before 2:1.22.0-15ubuntu1.4+tuxcare.els3 | 2:1.22.0-15ubuntu1.4+tuxcare.els3 |
busybox-syslogdTuxCare:Ubuntu:16.04 |
before 2:1.22.0-15ubuntu1.4+tuxcare.els3 | 2:1.22.0-15ubuntu1.4+tuxcare.els3 |
udhcpcTuxCare:Ubuntu:16.04 |
before 2:1.22.0-15ubuntu1.4+tuxcare.els3 | 2:1.22.0-15ubuntu1.4+tuxcare.els3 |
udhcpdTuxCare:Ubuntu:16.04 |
before 2:1.22.0-15ubuntu1.4+tuxcare.els3 | 2:1.22.0-15ubuntu1.4+tuxcare.els3 |
busyboxTuxCare:Ubuntu:18.04 |
before 1:1.27.2-2ubuntu3.4+tuxcare.els1 | 1:1.27.2-2ubuntu3.4+tuxcare.els1 |
busybox-initramfsTuxCare:Ubuntu:18.04 |
before 1:1.27.2-2ubuntu3.4+tuxcare.els1 | 1:1.27.2-2ubuntu3.4+tuxcare.els1 |
busybox-staticTuxCare:Ubuntu:18.04 |
before 1:1.27.2-2ubuntu3.4+tuxcare.els1 | 1:1.27.2-2ubuntu3.4+tuxcare.els1 |
busybox-syslogdTuxCare:Ubuntu:18.04 |
before 1:1.27.2-2ubuntu3.4+tuxcare.els1 | 1:1.27.2-2ubuntu3.4+tuxcare.els1 |
udhcpcTuxCare:Ubuntu:18.04 |
before 1:1.27.2-2ubuntu3.4+tuxcare.els1 | 1:1.27.2-2ubuntu3.4+tuxcare.els1 |
udhcpdTuxCare:Ubuntu:18.04 |
before 1:1.27.2-2ubuntu3.4+tuxcare.els1 | 1:1.27.2-2ubuntu3.4+tuxcare.els1 |
busyboxTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
busybox-staticTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
busybox-syslogdTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
udhcpcTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
udhcpdTuxCare:Debian:10 From an advisory covering 3 CVEs |
before 1:1.30.1-4+tuxcare.els3 | 1:1.30.1-4+tuxcare.els3 |
busyboxMageia:8 |
before 1.34.1-1.1.mga8 | 1.34.1-1.1.mga8 |
busyboxopenEuler:20.03-LTS-SP1 |
before 1.31.1-14.oe1 | 1.31.1-14.oe1 |
busyboxopenEuler:20.03-LTS-SP2 |
before 1.31.1-12.oe1 | 1.31.1-12.oe1 |
busyboxopenEuler:20.03-LTS-SP3 |
before 1.31.1-12.oe1 | 1.31.1-12.oe1 |
busyboxopenEuler:22.03-LTS |
before 1.34.1-14.oe2203 | 1.34.1-14.oe2203 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28391 is a high vulnerability (CVSS 8.8) in Busybox, published April 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.52%, the 89th percentile. Fixed in busybox 1.31.1-r22.
References
gitlab.alpinelinux.org/alpine/aports/-/issues/13661
git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch
nvd.nist.gov/vuln/detail/CVE-2022-28391
github.com/advisories/GHSA-h8c3-8522-vxc6
security.alpinelinux.org/vuln/CVE-2022-28391
Show 10 moreShow less
docs.bell-sw.com/security/cves/CVE-2022-28391
errata.cloudlinux.com/els6/CLSA-2022-1650376937.html
errata.tuxcare.com/els_os/debian10els/CLSA-2025-1762269073.html
advisories.mageia.org/MGASA-2022-0135.html
bugs.mageia.org/show_bug.cgi?id=30246
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1624