CVE-2024-25626 — OS Command Injection in Yocto

CWE-78 — OS Command Injection2 documents2 sources
Severity
9.8CRITICALNVD
CNA8.8
EPSS
1.4%
top 19.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Yoctoproject PokyLinuxfoundation Yocto
Timeline
PublishedFeb 19

Description

Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless of the hardware architecture. In Yocto Projects Bitbake before 2.6.2 (before and included Yocto Project 4.3.1), with the Toaster server (included in bitbake) running, missing input validation allows an attacker to perform a remote code execution in the server's shell via a crafted HTTP request. Authentication is not necessary. Toaster server execution has to be specifically ru…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5yoctoproject/poky< 3.1.31+2
▶NVDlinuxfoundation/yocto3.2 — 4.0.16+2

🔴Vulnerability Details

1
CVEList
Yocto Project Security Advisory - BitBake/Toaster↗2024-02-19
▶
CVE-2024-25626 — OS Command Injection in Yocto | cvebase