Summaryinfo

A vulnerability was found in Open Robotics ROS2 and classified as critical. The impacted element is the function nav2_dwb_controller. Such manipulation leads to permission. This vulnerability is listed as CVE-2024-41646. There is no available exploit. It is advisable to implement a patch to correct this issue. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Open Robotics ROS2 (the affected version is unknown). Affected by this issue is the function nav2_dwb_controller. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-41646 since 07/18/2024. The exploitation is known to be easy. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1222.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Open Robotics

Name

• ROS2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion