CVE ID

CVE-2024-30728

Title

Security Misconfiguration in ROS Kinetic Kame

Vulnerability Type

Security Misconfiguration

Severity

TBD

Vendor

The Open Source Robotics Foundation (OSRF)

Products Affected

ROS Kinetic Kame (ROS_VERSION=1 and ROS_PYTHON_VERSION=3)

Description

A significant security misconfiguration issue was identified in the default configurations of ROS Kinetic Kame. This vulnerability allows unauthenticated attackers to gain access using default credentials, posing a serious threat to the integrity and security of the system.

Impact

Unauthorized Access and Control; Data Breaches; System and Network Compromise; Operational Disruption; Increased Attack Surface; Social Engineering Risks.

Attack Vector

The vulnerability can be exploited through the use of default credentials, exploiting unchanged configuration settings, network scanning for vulnerable systems, and social engineering to gain unauthorized access.

Solution

It is critical for users to change the default configuration settings of ROS nodes immediately. Implementing custom, strong credentials and reviewing all configuration settings to ensure they meet security best practices are essential steps in mitigating this vulnerability.

Workaround

If immediate configuration changes are not feasible, heightened monitoring for unauthorized access and regular security audits of system settings are recommended. Users should also be educated about the risks of social engineering and the importance of maintaining secure configurations.

CVE Status

Confirmed and published.

Credit

Yash Patel and Dr. Parag Rughani

References

N/A