CVE-2022-21742: Realtek USB FE/1GbE/2.5GbE/5GbE NIC Family - Buffer Overflow

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-20 · updated 2026-06-17
Weakness: CWE-120

Description

Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker can exploit this vulnerability to disrupt services.

Affected products

Realtek Rtl8152B Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50
Realtek Rtl8153 Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50
Realtek Rtl8153B Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50
Realtek Rtl8154 Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50
Realtek Rtl8154B Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50
Realtek Rtl8156 Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50
Realtek Rtl8156B Firmware: from 7.42 through 7.53; from 8.49 through 8.60; from 10.28 before 10.50 — fixed in 10.50

How to fix

Upgrade to a fixed version: Realtek Rtl8152B Firmware 10.50; Realtek Rtl8153 Firmware 10.50; Realtek Rtl8153B Firmware 10.50; Realtek Rtl8154 Firmware 10.50; Realtek Rtl8154B Firmware 10.50; Realtek Rtl8156 Firmware 10.50; Realtek Rtl8156B Firmware 10.50. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21742 or the next vulnerability affects your stack