CVE-2022-43294

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-43294
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-43294.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-43294
Published
2022-11-14T00:00:00Z
Modified
2026-10-28T10:36:01Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/CRtspSession.cpp.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43294.json"
}
References

Affected packages

Git / github.com/arendst/tasmota

Affected ranges

Type
GIT
Repo
https://github.com/arendst/tasmota
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
066878da4d4762a9b6cb169fdf353e804d735cfd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "066878da4d4762a9b6cb169fdf353e804d735cfd"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v3.*
v3.9.11
v3.9.12
v3.9.14
v3.9.15
v3.9.16
v3.9.17
v3.9.18
v3.9.19
v3.9.20
v3.9.21
v3.9.22
v3.9.5
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.3.0
v5.4.0
v5.5.0
v5.5.1
v5.5.2
v5.6.1
v5.7.1
v6.*
v6.2.1
v6.3.0
v6.4.0
v6.4.1
v6.5.0
v6.6.0
v6.7.1
v7.*
v7.1.0
v7.1.1
v7.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-43294.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "319053354627752774288509639721937854887",
                "58190585165830929524668738732815025267",
                "33581685368052340401334330772962573556",
                "5734343312786931474985181411368861020",
                "219368683469529172324422952960407372217",
                "50755775250562904566896764934010014823",
                "17274399693753277843844809008828888233",
                "61576225470577040163244096053720233617",
                "261784848854810632991088246797444542053",
                "44112851187975795404195612796237223526",
                "109784624370926938881132710903201033669"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-43294-52f0842b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/arendst/tasmota/commit/066878da4d4762a9b6cb169fdf353e804d735cfd",
        "target":  {
            "file":  "lib/libesp32/rtsp/CRtspSession.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "274738501964416600780033918799414596873",
            "length":  4813
        },
        "id":  "CVE-2022-43294-98c5eb47",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/arendst/tasmota/commit/066878da4d4762a9b6cb169fdf353e804d735cfd",
        "target":  {
            "file":  "lib/libesp32/rtsp/CRtspSession.cpp",
            "function":  "CRtspSession::ParseRtspRequest"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:36:01Z"