CVE-2024-39289highCWE-94CWE-95

CVE-2024-39289: falha de alta gravidade em Open Source Robotics Foundation Robot…

Unsafe use of eval() method in rosparam tool

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Robot Operating System+ Monitorar ros-ros-comm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.2%
A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Open Source Robotics Foundation · Robot Operating System (ROS)
CVEs relacionadas — Open Source Robotics Foundation Robot…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-39780HIGHUse of unsafe yaml load in dynparamEPSS 0.4%CVE-2025-3753HIGHUnsafe use of eval() method in rosbag toolEPSS 0.2%CVE-2024-41921HIGHUnsafe use of eval() method in rostopic echo toolEPSS 0.2%CVE-2024-41148HIGHUnsafe use of eval() method in rostopic hz toolEPSS 0.2%CVE-2024-39835HIGHUnsafe use of eval() method in roslaunch toolEPSS 0.2%