CVE-2022-28664 - A memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1 · CoreCVE

Back Back to CVE browser

CRITICAL

A memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1

Published Aug 5, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.48%

Description

A memory corruption vulnerability exists in the httpd unescape functionality of FreshTomato 2022.1. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.The `freshtomato-mips` has a vulnerable URL-decoding feature that can lead to memory corruption.

Affected products

Vendor FreshTomato Product FreshTomato Default
n/a
- Version
  2022.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
2022.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (1)

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1509
ExploitTechnical DescriptionThird Party Advisory

Link	Providers	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1509		ExploitTechnical DescriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Aug 5, 2022

Updated Apr 15, 2025

Reserved Apr 5, 2022

Link CVE-2022-28664

CISA Vulnrichment

Updated Apr 15, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-28664

Severity n/a

Public date n/a

Links CVE-2022-28664