CVE-2022-27255: In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to…

PriorityP271critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

37.08%

98.3th percentile

In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
realtek	ecos_msdk_firmware	—	—
realtek	ecos_rsdk_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlgithub.com/infobyte/cve-2022-27255/tree/main/exploits_nexxt

snort

alert udp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Realtek eCos RSDK/MSDK Stack-based Buffer Overflow Attempt Inbound (CVE-2022-27255)"; content:"|20|SIP|2f|"; content:"m=audio|20|"; fast_pattern; pcre:"/^\d+\s*[^\r\n]{50,}/R"; reference:url,github.com/infobyte/cve-2022-27255/tree/main/exploits_nexxt; reference:cve,2022-27255; classtype:attempted-admin; sid:2038669; rev:1; metadata:created_at 2022_08_30, cve CVE_2022_27255, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_08_30;)

→Exploit arrives over UDP; match SIP protocol indicator '|20|SIP|2f|' (i.e. ' SIP/') in UDP payload targeting home/HTTP servers on any port.
→Look for SDP 'm=audio' lines followed by an abnormally long value (50+ non-CRLF characters) — this is the malicious SDP data triggering the stack-based buffer overflow in the SIP ALG.
→No authentication is required; the exploit is delivered via a single crafted inbound SIP/UDP packet — block or alert on malformed SDP audio port fields from untrusted sources.

·The Snort/Suricata rule targets [$HOME_NET,$HTTP_SERVERS] on ANY destination port over UDP — ensure HOME_NET is correctly scoped to include all Realtek eCos-based router/gateway segments to avoid missed detections.
·Affected versions are specifically Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1; the SIP ALG feature must be enabled on the device for the vulnerability to be exploitable.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.