Improper access control in BusyBox - CVE-2025-60876

Vulnerability identifier: #VU141560

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-60876

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to BusyBox wget accepting raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

BusyBox
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
iDRAC9
busybox-petitboot
busybox-help
busybox-debugsource
busybox-debuginfo
busybox
busybox-doc
busybox-shared
busybox-diffutils
busybox-tunctl
busybox-gawk
busybox-which
busybox-sha3sum
busybox-dos2unix
busybox-psmisc
busybox-sed
busybox-kmod
busybox-hostname
busybox-gzip
busybox-xz
busybox-attr
busybox-telnet
busybox-sysvinit-tools
busybox-hexedit
busybox-syslogd
busybox-procps
busybox-sh
busybox-coreutils
busybox-vi
busybox-bzip2
busybox-less
busybox-man
busybox-bc
busybox-wget
busybox-iproute2
busybox-iputils
busybox-policycoreutils
busybox-tar
busybox-udhcpc
busybox-selinux-tools
busybox-findutils
busybox-time
busybox-netcat
busybox-ncurses-utils
busybox-ed
busybox-adduser
busybox-links
busybox-traceroute
busybox-misc
busybox-unzip
busybox-sendmail
busybox-vlan
busybox-bind-utils
busybox-patch
busybox-grep
busybox-cpio
busybox-tftp
busybox-whois
busybox-sharutils
busybox-net-tools
busybox-util-linux
busybox-kbd
busybox-static-debuginfo
busybox-warewulf3-debuginfo
busybox-warewulf3
busybox-testsuite
busybox-static

Install updates from vendor's website.

BusyBox - update to 1.38.0
iDRAC9 - addressed in versions 7.00.00.184, 7.30.30.51
busybox-petitboot - addressed in versions 1.31.1-30, 1.34.1-30, 1.36.1-15, 1.36.1-16
busybox-help - addressed in versions 1.31.1-30, 1.34.1-30, 1.36.1-15, 1.36.1-16
busybox-debugsource - addressed in versions 1.31.1-30, 1.34.1-30, 1.36.1-15, 1.36.1-16
busybox-debuginfo - addressed in versions 1.31.1-30, 1.34.1-30, 1.36.1-15, 1.36.1-16
busybox - addressed in versions 1.31.1-30, 1.34.1-30, 1.36.1-15, 1.36.1-16
busybox-doc - update to 1.36.0-6
busybox - update to 1.36.0-6
busybox-petitboot - update to 1.36.0-6
busybox-shared - update to 1.36.0-6
busybox-diffutils - update to 1.37.0-150500.7.9.1
busybox-tunctl - update to 1.37.0-150500.7.9.1
busybox-gawk - update to 1.37.0-150500.7.9.1
busybox-which - update to 1.37.0-150500.7.9.1
busybox-sha3sum - update to 1.37.0-150500.7.9.1
busybox-dos2unix - update to 1.37.0-150500.7.9.1
busybox-psmisc - update to 1.37.0-150500.7.9.1
busybox-sed - update to 1.37.0-150500.7.9.1
busybox-kmod - update to 1.37.0-150500.7.9.1
busybox-hostname - update to 1.37.0-150500.7.9.1
busybox-gzip - update to 1.37.0-150500.7.9.1
busybox-xz - update to 1.37.0-150500.7.9.1
busybox-attr - update to 1.37.0-150500.7.9.1
busybox-telnet - update to 1.37.0-150500.7.9.1
busybox-sysvinit-tools - update to 1.37.0-150500.7.9.1
busybox-hexedit - update to 1.37.0-150500.7.9.1
busybox-syslogd - update to 1.37.0-150500.7.9.1
busybox-procps - update to 1.37.0-150500.7.9.1
busybox-sh - update to 1.37.0-150500.7.9.1
busybox-coreutils - update to 1.37.0-150500.7.9.1
busybox-vi - update to 1.37.0-150500.7.9.1
busybox-bzip2 - update to 1.37.0-150500.7.9.1
busybox-less - update to 1.37.0-150500.7.9.1
busybox-man - update to 1.37.0-150500.7.9.1
busybox-bc - update to 1.37.0-150500.7.9.1
busybox-wget - update to 1.37.0-150500.7.9.1
busybox-iproute2 - update to 1.37.0-150500.7.9.1
busybox-iputils - update to 1.37.0-150500.7.9.1
busybox-policycoreutils - update to 1.37.0-150500.7.9.1
busybox-tar - update to 1.37.0-150500.7.9.1
busybox-udhcpc - update to 1.37.0-150500.7.9.1
busybox-selinux-tools - update to 1.37.0-150500.7.9.1
busybox-findutils - update to 1.37.0-150500.7.9.1
busybox-time - update to 1.37.0-150500.7.9.1
busybox-netcat - update to 1.37.0-150500.7.9.1
busybox-ncurses-utils - update to 1.37.0-150500.7.9.1
busybox-ed - update to 1.37.0-150500.7.9.1
busybox-adduser - update to 1.37.0-150500.7.9.1
busybox-links - update to 1.37.0-150500.7.9.1
busybox-traceroute - update to 1.37.0-150500.7.9.1
busybox-misc - update to 1.37.0-150500.7.9.1
busybox-unzip - update to 1.37.0-150500.7.9.1
busybox-sendmail - update to 1.37.0-150500.7.9.1
busybox-vlan - update to 1.37.0-150500.7.9.1
busybox-bind-utils - update to 1.37.0-150500.7.9.1
busybox-patch - update to 1.37.0-150500.7.9.1
busybox-grep - update to 1.37.0-150500.7.9.1
busybox-cpio - update to 1.37.0-150500.7.9.1
busybox-tftp - update to 1.37.0-150500.7.9.1
busybox-whois - update to 1.37.0-150500.7.9.1
busybox-sharutils - update to 1.37.0-150500.7.9.1
busybox-net-tools - update to 1.37.0-150500.7.9.1
busybox-util-linux - update to 1.37.0-150500.7.9.1
busybox-kbd - update to 1.37.0-150500.7.9.1
busybox-static-debuginfo - update to 1.37.0-150500.10.14.1
busybox-warewulf3-debuginfo - update to 1.37.0-150500.10.14.1
busybox-warewulf3 - update to 1.37.0-150500.10.14.1
busybox-debugsource - update to 1.37.0-150500.10.14.1
busybox-debuginfo - update to 1.37.0-150500.10.14.1
busybox - addressed in versions 1.37.0-150500.10.14.1, 1.37.0-150700.18.10.1
busybox-testsuite - update to 1.37.0-150500.10.14.1
busybox-static - addressed in versions 1.37.0-150500.10.14.1, 1.37.0-150700.18.10.1

• https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092
• https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm
• https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html

• Improper access control in BusyBox
• Multiple vulnerabilities in Dell iDRAC9
• openEuler 24.03 LTS update for busybox
• openEuler 24.03 LTS SP2 update for busybox
• openEuler 24.03 LTS SP1 update for busybox
• openEuler 24.03 LTS SP3 update for busybox
• openEuler 22.03 LTS SP4 update for busybox
• openEuler 20.03 LTS SP4 update for busybox
• SUSE update for busybox
• SUSE update for busybox
• Anolis OS update for busybox