PT-2023-27118 · Busybox+1 · Busybox+1

Martin Schobert + 1 · Publicado 2023-08-28 · Atualizado 2025-07-25 · CVE-2023-39810

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Busybox version 1.33.2

Description An issue in the CPIO command of Busybox allows attackers to execute a directory traversal.

Recommendations For Busybox version 1.33.2, consider disabling the CPIO command until a patch is available. Restrict access to the CPIO command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

AZL-61539

AZL-61600

CVE-2023-39810

ECHO-CA8B-4D06-0A38

OESA-2025-1855

OESA-2025-1856

OESA-2025-1857

OESA-2025-1884

OESA-2025-1885

OESA-2025-1886

Produtos afetados

Busybox

Debian

Referências · 50

• https://pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability · Nota
• https://t.me/defcon_news/117441 · Publicação no Telegram
• https://t.me/rnetsec/19192 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-39810 · Aviso do Fabricante
• https://t.me/cibsecurity/69308 · Publicação no Telegram
• https://osv.dev/vulnerability/OESA-2025-1856 · Aviso do Fabricante
• https://docs.bell-sw.com/security/cves/CVE-2023-39810 · Nota
• https://osv.dev/vulnerability/OESA-2025-1884 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1855 · Nota
• http://openwall.com/lists/oss-security/2025/04/23/3 · Nota
• http://openwall.com/lists/oss-security/2025/04/23/1 · Nota
• https://osv.dev/vulnerability/BELL-CVE-2023-39810 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2025/04/24/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-46394 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-61539 · Aviso do Fabricante