CVE-2022-28391

HIGH

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose t...

Affects 1 product across 3 vendors.

BCS7.52
CVSS 3.18.8
EPSS3.5%
Percentile88th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-88: CWE-88
◆ SAGE Intelligence — CITED Relevance Research Team

CVE-2022-28391 affects BusyBox versions up to 1.35.0, allowing remote attackers to execute arbitrary code when netstat is used to print a DNS PTR record's value to a VT compatible terminal. This vulnerability has a CVSS score of 8.8, indicating high severity. The affected vendors include Busybox, Fujitsu-Siemens, and Siemens. No public proof of concept or exploit is available, and the EPSS score suggests a low likelihood of exploitation in the wild.

BSID: BS-2022-GLOBAL-069531-H • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-28391?
CVE-2022-28391 affects BusyBox versions up to 1.35.0, allowing remote attackers to execute arbitrary code when netstat is used to print a DNS PTR record's value to a VT compatible terminal. This vulnerability has a CVSS score of 8.8, indicating high severity. The affected vendors include Busybox, Fujitsu-Siemens, and Siemens. No public proof of concept or exploit is available, and the EPSS score suggests a low likelihood of exploitation in the wild.
What is the CVSS score for CVE-2022-28391?
CVE-2022-28391 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 3.5%.
Is CVE-2022-28391 actively exploited?
No confirmed active exploitation of CVE-2022-28391 as of 2026-05-30.
How do I remediate CVE-2022-28391?
Priority: MEDIUM. Advisory: https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch PSIRT: [email protected]
What systems are affected by CVE-2022-28391?
CVE-2022-28391 affects: Busybox, Fujitsu-Siemens, Siemens.
What NERC-CIP standard applies to CVE-2022-28391?
NERC CIP CIP-007 CIP-007-R2: This CVE violates CIP-007-R2 because it allows unauthorized access to critical cyber assets, which can compromise the reliability and security of the power grid.
What IEC 62443 requirement maps to CVE-2022-28391?
IEC 62443 SR 7.6: This CVE maps to SR 7.6 because it involves the protection of communication channels against unauthorized access and manipulation, which is essential for maintaining the security of industrial control systems.
Vulnerability Details
CVE IDCVE-2022-28391
BSIDBS-2022-GLOBAL-069531-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2022-04-03
Last Modified2025-06-09
ICS Relevance55%
Weakness (CWE)
Verticals
ICS-OT
SourceNVD
Official Description

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability can be exploited by a remote attacker who can manipulate DNS PTR records. When the netstat command is used to display these records on a VT compatible terminal, the attacker can inject malicious code that is executed with the privileges of the user running netstat. This can lead to unauthorized access, data manipulation, and potential system compromise.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductFixed Version
Busybox Busybox
Fujitsu-Siemens —
Siemens —
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 1560 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
● Virtual Patch — CITED Relevance SAGE Engine MEDIUM CONFIDENCE

Implement network segmentation to isolate critical systems from untrusted networks. Use DNSSEC to ensure the integrity of DNS responses. Regularly update BusyBox to the latest version to mitigate known vulnerabilities.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R2
This CVE violates CIP-007-R2 because it allows unauthorized access to critical cyber assets, which can compromise the reliability and security of the power grid.
IEC 62443: SR 7.6
This CVE maps to SR 7.6 because it involves the protection of communication channels against unauthorized access and manipulation, which is essential for maintaining the security of industrial control systems.

Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.

SAGE Enrichment Record — provenance & audit hash
ModelQwen/Qwen2.5-72B-Instruct-AWQ
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash85e56aec01bd8e61e9e2258fb1613a1714f9008d8c96890a4be3bfe1ba975a03673543061f44ec5fe8e9c54ac36c9e765ba32940a9da08a1b6eab6f0f32f36d5
Related CVEs affecting Busybox
CVE-2022-48174 9.8 There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35.... CVE-2018-1000517 9.8 BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e0... CVE-2016-2148 9.8 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25... CVE-2021-42377 9.8 An attacker-controlled pointer free in Busybox's hush applet leads to denial ... CVE-2017-16544 8.8 In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the ...
View all Busybox CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider monitors 353,228 CVEs across ICS/OT vendors. SAGE-enriched alerts with virtual patches, NERC-CIP mapping, and PSIRT contacts delivered to your SIEM in minutes.

Join free →