CVE-2024-39289: openrobotics robot operating system

csirt@kutim:~/threat-intel/cve/CVE-2024-39289

CVSS 7.8 · High EPSS 0,19%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada openrobotics robot operating system. Skor CVSS 3.1 7.8 (High) menurut ubuntu.com.

Deskripsi (NVD)

A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.

Rincian

Terbit di NVD: 17 Juli 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber ubuntu.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
EPSS (30 hari): 0,19% peluang dieksploitasi; lebih tinggi dari 8,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openrobotics	robot operating system	Versi indigo_igloo
openrobotics	robot operating system	Versi kinetic_kame
openrobotics	robot operating system	Versi melodic_morenia
openrobotics	robot operating system	Versi noetic_ninjemys

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.ros.org/blog/noetic-eol/ product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.