CVE-2024-58251

Published: Apr 23, 2025Modified: Jun 17, 2026Deferred

2.5

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Exploitability: 1.0 / Impact: 1.4

Source: MITRE (Secondary)

Description

In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.

Related CWEs

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References (4)

https://bugs.busybox.net/show_bug.cgi?id=15922

Source: cve@mitre.org

https://www.busybox.net

Source: cve@mitre.org

https://www.busybox.net/downloads/

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2025/04/23/6

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.