EUVD-2026-41221
GHSA-866x-255q-hx3g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated ROS topics give PR:N and a single crafted message gives AC:L; impact is a controller crash (A:H) with no confidentiality or integrity effect, though AV:N assumes ROS network reachability.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted geometry_msgs::Twist message.
AnalysisAI
Denial of service in the gazebo_plugins package (v3.9.0), specifically the differential-drive controller gazebo_ros_diff_drive.cpp, lets attackers crash the affected simulation/robot-control node by publishing a specially crafted geometry_msgs::Twist velocity command. Any actor able to reach the relevant ROS topic can trigger the fault because the plugin fails to validate the incoming message before processing it (CWE-20). Reported via MITRE with a public proof-of-concept (demo video and technical write-up); not listed in CISA KEV, and EPSS exploitation probability is low at 0.15% (5th percentile).
Technical ContextAI
gazebo_plugins provides ROS-integrated plugins for the Gazebo robotics simulator; gazebo_ros_diff_drive is the differential-drive controller that subscribes to a cmd_vel-style topic carrying geometry_msgs::Twist messages (linear and angular velocity vectors) and translates them into wheel commands. The root cause is CWE-20 (Improper Input Validation): the plugin consumes attacker-controllable numeric fields from the Twist message without sanity/bounds checking, so a crafted message (e.g., malformed or out-of-range values such as NaN/Inf or extreme magnitudes) drives the plugin into a crashing or unrecoverable state, denying availability of the controller/simulation. ROS 1 topic transport is unauthenticated by design, so message injection depends only on network reachability to the ROS graph rather than on any credential.
RemediationAI
No vendor-released patched version is identified in the provided data at time of analysis, and EUVD does not enumerate a fixed release, so track the gazebo_plugins/gazebo_ros upstream project for a corrected release and upgrade off 3.9.0 once published. As compensating controls, restrict who can publish to the differential-drive command topic: isolate the ROS master and topics on a dedicated, firewalled robot network segment (never expose the ROS master port, default 11311, or DDS discovery ports to untrusted networks), and where feasible migrate to ROS 2 with SROS2/DDS security to authenticate and authorize publishers - the trade-off is configuration and performance overhead. Additionally, add input validation/clamping (reject NaN/Inf and bound velocity magnitudes) at the consuming node or via a filtering relay node in front of the diff-drive controller; the side effect is added latency and the need to tune acceptable velocity ranges. Consult the technical write-up at https://github.com/REYu6/ROS-vul/blob/main/Gazebo%20CVE/gazebo_ros_diff_drive.md for the exact crafted-message pattern to filter.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today