Arbitrary Code Execution Vulnerability in ROS2 navigation2 v.humble
CVE-2024-41646

9.8CRITICAL

Key Information:

Vendor

Open Robotics

Status
Robot Operating System
Vendor
CVE Published:
6 December 2024

What is CVE-2024-41646?

The vulnerability within Open Robotics' Robotic Operating System 2 (ROS2) Navigation2, specifically in version humble, exposes the system to risks due to insecure permissions. This flaw allows an attacker to run arbitrary code through a specially crafted script directed at the nav2_dwb_controller module. Successful exploitation of this vulnerability can lead to unauthorized access and potential manipulation of robotic processes, underscoring the importance of patching and securing the affected systems to maintain operational integrity.

References

https://github.com/GoesM/ROS-CVE-CNVDs
https://github.com/ros-navigation/navigation2/issues/4437
https://github.com/ros-navigation/navigation2/pull/4463

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.