CVE-2022-38767

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-25 · updated 2026-06-17

Description

An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial of Service during the IP Radius access procedure.

Affected products

Windriver Vxworks: from 6.9 before 6.9.4.12; 6.9.4.12, 6.9.4.12-rolling_cumulative_patch_layer1, 6.9.4.12-rolling_cumulative_patch_layer2, 6.9.4.12-rolling_cumulative_patch_layer3, 6.9.4.12-rolling_cumulative_patch_layer4, 6.9.4.12-rolling_cumulative_patch_layer5 (+1) — fixed in 6.9.4.12

How to fix

Upgrade to a fixed version: Windriver Vxworks 6.9.4.12. Check the vendor advisory for mitigations.

References

https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2022-38767
https://windriver.com
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2022-38767
https://windriver.com
https://cert-portal.siemens.com/productcert/html/ssa-726834.html

Get alerted when CVE-2022-38767 or the next vulnerability affects your stack