---
cve: "CVE-2024-41645"
severity: "CRITICAL"
cvss: 9.8
epss: "0.7%"
vendor: "n/a"
kev: false
exploited: false
published: "2024-12-06 22:15:20"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T16:56:42+02:00"
---

# CVE-2024-41645

> 9.8 CRITICAL · 🧪 PoC

## Beschreibung

Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2024-12-11 19:16:34

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-281** — Improper Preservation of Permissions
  The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

## Referenzen

- <https://github.com/ros-navigation/navigation2/pull/4521>
- <https://github.com/ros-navigation/navigation2/issues/4497>
- <https://github.com/GoesM/ROS-CVE-CNVDs>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-41645/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_