Is CVE-2022-30065 actively exploited?

No active exploitation of CVE-2022-30065 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-30065 be exploited remotely?

No. CVE-2022-30065 requires local access to exploit.

What is the CVSS score of CVE-2022-30065?

CVE-2022-30065 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2022-30065

HIGH

CVE-2022-30065

CWE-416Published: May 18, 2022· Updated: Jul 7, 2026

7.8

CVSS v3.1

Official Description

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function.

NVD Source

Technical Analysis

CVE-2022-30065 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.None

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors & Products

busybox1 product(s)

busybox

siemens12 product(s)

scalance sc622-2c firmwarescalance sc622-2cscalance sc626-2c firmwarescalance sc626-2cscalance sc632-2c firmwarescalance sc632-2cscalance sc636-2c firmwarescalance sc636-2cscalance sc642-2c firmwarescalance sc642-2cscalance sc646-2c firmwarescalance sc646-2c

Source: NVD CPE · 13 total CPE entries