ZDI-CAN-27555
MEDIUM 6.5
Overdue
Jul 31, 2025
BusyBox
BusyBox is a widely-used lightweight Unix utility suite commonly embedded in IoT devices, routers, and embedded Linux systems. This medium-severity vulnerability (CVSS 6.5) can be exploited remotely without authentication or user interaction, though it requires specific conditions to trigger, and primarily compromises confidentiality with minimal impact to integrity. Security teams should monitor for patches from their device manufacturers and audit systems running BusyBox for exposure, particularly in network-connected embedded devices.
Advisory Details
Researcher
Discovered by:
Ryota Shiga (GMO Flatt Security Inc.) with takumi-san.ai
Reported
July 31, 2025
Deadline
November 28, 2025
139d overdue
CVSS Vector
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N