Improper Certificate Validation in BusyBox - CVE-2018-1000500
Published: June 26, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU37004
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-1000500
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: busybox.net
Affected software:
BusyBox
BusyBox
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
How to mitigate CVE-2018-1000500
Install update from vendor's website.