What is the CVSS score of CVE-2022-21742?

CVE-2022-21742 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Rtl8156 Firmware CVE-2022-21742

MEDIUM

Classic Buffer Overflow (CWE-120)

2022-06-20 twcert@cert.org.tw

Buffer Overflow Rtl8156 Firmware Rtl8156B Firmware Rtl8153 Firmware Rtl8153B Firmware Rtl8154 Firmware Rtl8154B Firmware Rtl8152B Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Jun 20, 2022 - 06:15 nvd

MEDIUM 6.5

DescriptionNVD

Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services.

AnalysisAI

Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services. Affected products include: Realtek Rtl8156 Firmware, Realtek Rtl8156B Firmware, Realtek Rtl8153 Firmware, Realtek Rtl8153B Firmware, Realtek Rtl8154 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.