CVE-2024-30964

EUVD-2024-28882
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the initial_pose_sub thread created by nav2_bt_navigator
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
open_roboticsros2_navigation2
𝑥
≤ *
ADP
open_roboticsros2_humble
𝑥
≤ *
ADP
open_roboticsnav2_humble
𝑥
≤ *
ADP
Common Weakness Enumeration
References
https://github.com/GoesM/ROS-CVE-CNVDs
https://github.com/ros-planning/navigation2/issues/4166
https://github.com/ros-planning/navigation2/pull/4176