fkie_cve-2024-39289
Vulnerability from fkie_nvd
Published
2025-07-17 20:15
Modified
2025-08-26 17:51
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.
References
security@ubuntu.comhttps://www.ros.org/blog/noetic-eol/Product
Impacted products
Vendor Product Version
openrobotics robot_operating_system indigo_igloo
openrobotics robot_operating_system kinetic_kame
openrobotics robot_operating_system melodic_morenia
openrobotics robot_operating_system noetic_ninjemys


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:openrobotics:robot_operating_system:indigo_igloo:*:*:*:*:*:*:*",
              "matchCriteriaId": "0673568E-BE13-4D10-9E7B-57B6D38850B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:openrobotics:robot_operating_system:kinetic_kame:*:*:*:*:*:*:*",
              "matchCriteriaId": "429E39E2-7812-44F3-B3DB-D82561432B88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:openrobotics:robot_operating_system:melodic_morenia:*:*:*:*:*:*:*",
              "matchCriteriaId": "C319FA37-A18B-4706-9B29-827BA81CB5B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:openrobotics:robot_operating_system:noetic_ninjemys:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F466D1C-796D-4857-BEDF-FA600DF47669",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A code execution vulnerability has been discovered in the Robot Operating System (ROS) \u0027rosparam\u0027 tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo en la herramienta \u0027rosparam\u0027 del Robot Operating System (ROS), que afecta a las distribuciones de ROS Noetic Ninjemys y anteriores. La vulnerabilidad se debe al uso de la funci\u00f3n eval() para procesar valores de par\u00e1metros no depurados, proporcionados por el usuario, mediante convertidores especiales para representaciones de \u00e1ngulos en radianes. Esta falla permit\u00eda a los atacantes manipular y ejecutar c\u00f3digo Python arbitrario."
    }
  ],
  "id": "CVE-2024-39289",
  "lastModified": "2025-08-26T17:51:50.470",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-17T20:15:27.230",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Product"
      ],
      "url": "https://www.ros.org/blog/noetic-eol/"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ],
      "source": "security@ubuntu.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.