CVE-2024-39835highCWE-94CWE-95

CVE-2024-39835: fallo de gravedad alta en Open Source Robotics Foundation Robot…

Unsafe use of eval() method in roslaunch tool

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Robot Operating System+ Monitorear ros-ros-comm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.8epss 0.2%
A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() method to process user-supplied, unsanitized parameter values within the substitution args mechanism, which roslaunch evaluates before launching a node. This flaw allows attackers to craft and execute arbitrary Python code.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Open Source Robotics Foundation · Robot Operating System (ROS)
CVEs relacionadas — Open Source Robotics Foundation Robot…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-39780HIGHUse of unsafe yaml load in dynparamEPSS 0.4%CVE-2025-3753HIGHUnsafe use of eval() method in rosbag toolEPSS 0.2%CVE-2024-41921HIGHUnsafe use of eval() method in rostopic echo toolEPSS 0.2%CVE-2024-41148HIGHUnsafe use of eval() method in rostopic hz toolEPSS 0.2%CVE-2024-39289HIGHUnsafe use of eval() method in rosparam toolEPSS 0.2%