CVE-2024-30961: Code Injection

Published Dec 5, 2024

Updated

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the error-thrown mechanism in nav2btnavigator.

Affected Software

2 affected components

Openrobotics Robot Operating System=2-humble

Openrobotics Robot Operating System=2-iron

Event History

Dec 5, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-30961?

CVE-2024-30961 has been classified as a high severity vulnerability due to its potential to allow local attackers to execute arbitrary code.

How do I fix CVE-2024-30961?

To fix CVE-2024-30961, upgrade affected versions of Open Robotics Robotic Operating System 2 (ROS2) to the latest patched releases.

What versions are affected by CVE-2024-30961?

CVE-2024-30961 affects Open Robotics Robot Operating System 2 versions 2-humble and 2-iron.

What type of attacks can exploit CVE-2024-30961?

CVE-2024-30961 can be exploited by local attackers to execute arbitrary code through the error-thrown mechanism in nav2_bt_navigator.

Is the CVE-2024-30961 vulnerability easy to exploit?

The exploitation of CVE-2024-30961 requires local access to the system, which may limit the risk but still poses significant security threats.