CVE-2022-32665

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-03 · updated 2026-06-17
Weakness: CWE-77

Description

In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20220026; Issue ID: OSBNB00144124.

Affected products

Mediatek Linkit Software Development Kit: before tlb7.3.258.100-p1-1555 — fixed in tlb7.3.258.100-p1-1555

How to fix

Upgrade to a fixed version: Mediatek Linkit Software Development Kit tlb7.3.258.100-p1-1555. Check the vendor advisory for mitigations.

References

https://corp.mediatek.com/product-security-bulletin/January-2023
https://corp.mediatek.com/product-security-bulletin/January-2023

Get alerted when CVE-2022-32665 or the next vulnerability affects your stack