CVE-2024-39289 - CVE House

Back to Database

Status published High CVE-2024-39289

Unsafe use of eval() method in rosparam tool

7.8 CVSS

Vulnerability Description

A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39289

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Florencia Cabral Berenfus, Ubuntu Robotics Team

References

https://www.ros.org/blog/noetic-eol/

More from Open Source Robotics Foundation

View All →

Unsafe use of eval() method in rosbag tool

Unsafe use of eval() method in rostopic echo tool

Unsafe use of eval() method in rostopic hz tool

Unsafe use of eval() method in roslaunch tool

Use of unsafe yaml load in dynparam

Affected Vendor

Open Source Robotics Foundation

View all reports →

Affected Software

Robot Operating System (ROS)

Vulnerable Versions:

Noetic Ninjemys, Melodic Morenia, Kinetic Kame, Indigo Igloo

Timeline

Official Publish: July 17th, 2025

Last Modified: July 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation