CVE-2024-41148highCWE-94CWE-95

CVE-2024-41148: fallo de gravedad alta en Open Source Robotics Foundation Robot…

Unsafe use of eval() method in rostopic hz tool

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Robot Operating System+ Monitorear ros-ros-comm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.8epss 0.2%
A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Open Source Robotics Foundation · Robot Operating System (ROS)
CVEs relacionadas — Open Source Robotics Foundation Robot…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-39780HIGHUse of unsafe yaml load in dynparamEPSS 0.4%CVE-2025-3753HIGHUnsafe use of eval() method in rosbag toolEPSS 0.2%CVE-2024-41921HIGHUnsafe use of eval() method in rostopic echo toolEPSS 0.2%CVE-2024-39289HIGHUnsafe use of eval() method in rosparam toolEPSS 0.2%CVE-2024-39835HIGHUnsafe use of eval() method in roslaunch toolEPSS 0.2%