EUVD-2026-62225
GHSA-xwfg-2qxj-cwwg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privileges required to invoke wget; sole impact is a process-level crash with no confidentiality or integrity effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.
AnalysisAI
BusyBox wget's FEATURE_WGET_TIMEOUT handler in networking/wget.c crashes with a null pointer dereference when the -T (timeout) argument is processed, affecting versions 1.30.0 and 1.30.1. Local users who can invoke BusyBox wget can trigger a denial-of-service crash of the wget process by supplying a crafted -T argument value, exploiting an unguarded pointer dereference in the shared getopt32 option-parsing library. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access to a system running BusyBox 1.30.0 or 1.30.1 with FEATURE_WGET_TIMEOUT enabled at compile time. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 1.9 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) accurately captures the constrained impact: local access is required, confidentiality and integrity are wholly unaffected, and the only outcome is a low-severity crash of the wget process itself rather than the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with shell access on an embedded Linux system - such as an IoT device, router, or Alpine-based container - running BusyBox 1.30.0 or 1.30.1 invokes wget with a crafted -T argument that triggers the null pointer dereference in the getopt32 timeout option handler, immediately crashing the wget process. A public proof-of-concept is available at https://gist.github.com/wyxstarry/5c199ec824928c5ae5816aaecbc6df03, lowering the skill threshold for reproduction. … |
| Remediation | Apply upstream patch commit 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff available at https://github.com/mirror/busybox/commit/83a40bf7a93c8ac093d33ab452222dd5b9eb57ff, which adds a null guard in libbb/getopt32.c before dereferencing on_off->optarg. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecif
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of servi
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a
An issue was discovered in BusyBox through 1.30.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow
The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that m
A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. Rated medium severit
A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar functio
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today