VDB

CVE-2022-2526

CVE-2022-2526 PUBLISHED CVSS 8.800000190734863 HIGH

A use-after-free vulnerability was found in system. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later, allowing authenticated user to execute arbitrary code.

EPSS 0.30% · 53.2th percentile

Risk Scores

CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R
EPSS Score
0.30%
53.2th percentile

Affected Products

VendorProductVersions
ABBABB M2M Gateway SW, software versions >=5.0.1|<=5.0.3
ABBABB M2M Gateway ARM600, firmware versions >=4.1.2|<=5.0.3

Exploit Intelligence

…and 3 more exploits

Timeline

  • Aug 24, 2022 CVE Published
  • Sep 10, 2022 EPSS Score
  • Oct 25, 2022 EPSS Score
  • Dec 9, 2022 EPSS Score
  • Jan 23, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Apr 24, 2023 EPSS Score
  • Jun 8, 2023 EPSS Score
  • Jul 23, 2023 EPSS Score
  • Sep 6, 2023 EPSS Score
  • Oct 21, 2023 EPSS Score
  • Dec 5, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›