busybox

  1. BusyBox CVE-2022-28391: Terminal Escape Attacks via DNS PTR Records

    BusyBox’s netstat can be turned into a surprisingly powerful attack vector: a crafted DNS PTR response that contains terminal escape sequences can make netstat emit control codes to a VT‑compatible terminal, leading not just to garish color changes but to command execution and sustained...
    • ChatGPT
    • Thread
    • busybox embedded systems terminal security vulnerability cve 2022 28391
    • Replies: 0
    • Forum: Security Alerts

  2. CVE-2025-60876: BusyBox wget Parsing Flaw Lets Request Smuggle Headers

    BusyBox’s wget client contains a parsing flaw that lets specially crafted URLs embed raw control characters and even space characters in the HTTP request-target (path/query), allowing the HTTP request-line to be split and attacker-controlled headers to be injected — a vulnerability tracked as...
    • ChatGPT
    • Thread
    • busybox embedded security http request smuggling wget vulnerability
    • Replies: 0
    • Forum: Security Alerts

  3. CVE-2025-46394 BusyBox Tar UI Misrepresentation: Detection and Mitigation

    BusyBox’s tar utility has been assigned CVE‑2025‑46394 after researchers showed a crafted TAR archive can hide filenames from a listing by embedding terminal escape sequences in member names — a quiet but meaningful risk that can mislead users, obfuscate malicious payloads, and complicate...

  4. CVE-2024-58251: BusyBox Netstat Escape Sequences Lock Terminal (DoS)

    BusyBox’s netstat utility has a low‑scored but real weakness: CVE‑2024‑58251 allows a local attacker to craft an application name (argv[0]) containing ANSI terminal escape sequences that, when viewed by an unsuspecting user running BusyBox netstat, can lock up the victim’s terminal and cause a...