CVE-2022-28391 Command injection in n/a

High 8.8 Published 3 Apr 2022 Updated 9 Jun 2025

Remote attackers can execute arbitrary code or alter terminal colors via crafted DNS PTR records when BusyBox netstat is used.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-28391?

CVE-2022-28391 is a high-severity command injection vulnerability in n/a, published on 3 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.

Weakness: CWE-88

Which versions are affected by CVE-2022-28391?

It affects 1 product.

Products include Busybox Busybox.

How do I fix CVE-2022-28391?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-28391 being exploited?

There is no known exploitation of CVE-2022-28391 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2022-28391, AZL-41790, AZL-9311, CLSA-2022-1650376937, CLSA-2022-1650377094, CLSA-2022-1650377131 and 4 more.