CVE-2024-39780: openrobotics robot operating system

csirt@kutim:~/threat-intel/cve/CVE-2024-39780

CVSS 9.8 · Critical EPSS 0,40%

Kerentanan Improper Input Validation pada openrobotics robot operating system. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.

Rincian

Terbit di NVD: 2 April 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 0,40% peluang dieksploitasi; lebih tinggi dari 31,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openrobotics	robot operating system	Versi indigo_igloo
openrobotics	robot operating system	Versi kinetic_kame
openrobotics	robot operating system	Versi melodic_morenia
openrobotics	robot operating system	Versi noetic_ninjemys

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/ros/dynamic_reconfigure/pull/202 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.