CVE-2022-28391

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.

• CWE-88

• https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patchMailing List, Patch, Vendor Advisory
• https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patchMailing List, Patch, Vendor Advisory
• https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661Exploit, Patch, Vendor Advisory
• https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patchMailing List, Patch, Vendor Advisory
• https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patchMailing List, Patch, Vendor Advisory
• https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661Exploit, Patch, Vendor Advisory

Published

Apr 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28386An issue was discovered in certain Verbatim drives through 2…4.6
• CVE-2022-28387An issue was discovered in certain Verbatim drives through 2…4.6
• CVE-2022-28388usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the…5.5
• CVE-2022-28389mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the…5.5
• CVE-2022-2839The Zephyr Project Manager WordPress plugin before 3.2.55 do…5.4
• CVE-2022-28390ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the L…7.8
• CVE-2022-28394EOL Product CVE - Installer of Trend Micro Password Manager …7.8
• CVE-2022-28396Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-28397An arbitrary file upload vulnerability in the file upload mo…9.8
• CVE-2022-2840The Zephyr Project Manager WordPress plugin before 3.2.5 doe…9.8
• CVE-2022-2841A vulnerability was found in CrowdStrike Falcon 6.31.14505.0…2.7
• CVE-2022-28410Simple Real Estate Portal System v1.0 was discovered to cont…9.8