Cyber Resilience

CVE-2022-21742

Medium

Published: 20 June 2022

Published
20 June 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0014 33.8th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-21742 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Realtek Rtl8156 Firmware. Its CVSS base score is 6.2 (Medium).

Operationally, ranked at the 33.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services.

CWE(s)
CWE-120

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

realtek
rtl8156 firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50
realtek
rtl8156b firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50
realtek
rtl8153 firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50
realtek
rtl8153b firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50
realtek
rtl8154 firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50
realtek
rtl8154b firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50
realtek
rtl8152b firmware
7.42 — 7.53 · 8.49 — 8.60 · 10.28 — 10.50

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

References