SB2026081244 - Improper access control in BusyBox

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2025-60876)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to BusyBox wget accepting raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Remediation

Install update from vendor's website.

References

• https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092
• https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm
• https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html