CVE-2024-41646
Published: 06 December 2024
Summary
CVE-2024-41646 is a critical-severity Improper Preservation of Permissions (CWE-281) vulnerability in Openrobotics Robot Operating System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39334
Vulnerability details
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure permissions in ROS2 navigation2 allow attackers to abuse file system permissions weakness (T1044) by placing a crafted executable script that the nav2_dwb_controller executes, akin to executable file permissions weakness (T1574.005), enabling arbitrary code execution.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.