CVE-2024-30661
Unauthorized Information Access Vulnerability in ROS Melodic Morenia
Unauthorized Information Access
TBD
The Open Source Robotics Foundation (OSRF)
ROS Melodic Morenia (ROS_VERSION=1 and ROS_PYTHON_VERSION=3)
An unauthorized access vulnerability has been discovered in ROS Melodic Morenia versions where ROS_VERSION is 1 and ROS_PYTHON_VERSION is 3. This vulnerability could potentially allow a malicious user to gain unauthorized information access to multiple ROS nodes remotely. Unauthorized information access to these nodes could result in compromised system integrity, the execution of arbitrary commands, and disclosure of sensitive information.
The successful exploitation of this vulnerability could enable an attacker to gain unauthorized information access to multiple ROS nodes. This situation may compromise the system's integrity and result in the loss of confidentiality and control over robotic operations. The implications could be severe, depending on the affected system's nature and functionality.
The vulnerability can be exploited remotely. The detailed specifics of the attack vector are not disclosed to avoid exploitation.
ROS users are strongly advised to update their systems to the latest available version promptly. In addition, users should stay informed on advisories from the ROS development team for up-to-date information and further instructions. Implementing strict access controls and using strong, unique credentials can serve as interim mitigation measures against potential unauthorized access.
There is currently no known workaround for this vulnerability. The primary mitigation is to update to a patched version as soon as it is available.
Confirmed and published.
Yash Patel and Dr. Parag Rughani