CVE-2024-39780 - CVE House
Back to Database
Status published High CVE-2024-39780

Use of unsafe yaml load in dynparam

Vulnerability Description

A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39780

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Florencia Cabral Berenfus, Ubuntu Robotics Team

References

More from Open Source Robotics Foundation

View All →
CVE-2025-3753
Unsafe use of eval() method in rosbag tool
High 7.8
CVE-2024-41921
Unsafe use of eval() method in rostopic echo tool
High 7.8
CVE-2024-41148
Unsafe use of eval() method in rostopic hz tool
High 7.8
CVE-2024-39835
Unsafe use of eval() method in roslaunch tool
High 7.8
CVE-2024-39289
Unsafe use of eval() method in rosparam tool
High 7.8

Affected Vendor

Open Source Robotics Foundation

View all reports →

Affected Software

Robot Operating System (ROS)
Vulnerable Versions:
Noetic Ninjemys, Melodic Morenia, Kinetic Kame, Indigo Igloo

Timeline

Official Publish: April 2nd, 2025
Last Modified: June 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502 CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact