Description
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
References (5)
Core 5
Core References
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-585531.html
Issue Tracking, Vendor Advisory
https://bugs.busybox.net/show_bug.cgi?id=15216
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241129-0001/
Scores
CVSS v3
9.8
EPSS
0.0313
EPSS Percentile
86.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-787
Status
published
Products (2)
busybox/busybox
< 1.36.1
debian/debian_linux
11.0
Published
Aug 22, 2023
Tracked Since
Feb 18, 2026