Missing SSL Certificate Validation in BusyBox Wget Applet
CVE-2018-1000500

8.1HIGH

Key Information:

Vendor: Busybox
Status: Busybox
Vendor: CVE Published:; 26 June 2018

What is CVE-2018-1000500?

The BusyBox utility suite, specifically the 'wget' applet, contains a vulnerability where SSL certificate validation is effectively missing. This flaw enables attackers to execute arbitrary code by tricking users into downloading malicious files over HTTPS from a compromised domain. When a user runs 'busybox wget' on an affected version, it does not properly verify the server's SSL certificate, exposing the system to potential exploitation risks. Users are advised to upgrade to the latest version to mitigate this vulnerability.