CVE ID

CVE-2024-30697

Title

Information Leakage in ROS2 Galactic Geochelone via Plaintext Message Transmission

Vulnerability Type

Information Leakage and Unauthorized Access to Sensitive Data

Severity

TBD

Vendor

The Open Source Robotics Foundation (OSRF)

Products Affected

ROS2 Galactic Geochelone (ROS_VERSION=2 and ROS_PYTHON_VERSION=3)

Description

A critical vulnerability has been discovered in ROS2 Galactic Geochelone, where the system transmits messages in plaintext. This flaw exposes sensitive information, making it vulnerable to man-in-the-middle (MitM) attacks, and allowing attackers to easily intercept and access this data.

Impact

Information Leakage; Data Integrity Concerns; Loss of Trust; Operational Disruption; Broader Network Compromise.

Attack Vector

The vulnerability can be exploited through network sniffing, man-in-the-middle attacks, and unauthorized network access.

Solution

To address this vulnerability, it is essential to implement secure communication protocols that encrypt data during transmission. Users should update to a version of ROS2 that provides these security measures or apply available patches that rectify this issue.

Workaround

In the absence of an immediate solution, users should employ network security measures such as VPNs, monitor network traffic for unusual patterns indicative of eavesdropping, and ensure sensitive data is encrypted at the application level.

CVE Status

Confirmed and published.

Credit

Yash Patel and Dr. Parag Rughani

References

N/A