Openrobotics
Openrobotics Robot Operating System: vulnerabilities and CVEs
Openrobotics Robot Operating System has 32 published vulnerabilities, 0 of them in the last 12 months. 17 are rated critical and 0 are listed by CISA as actively exploited.
CVEs32
Last 12 months0
Critical17
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-3753 | High (7.8) | 0.19% | — | Jul 17, 2025 | A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function… |
| CVE-2024-41921 | High (7.8) | 0.19% | — | Jul 17, 2025 | A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'echo' verb,… |
| CVE-2024-41148 | High (7.8) | 0.19% | — | Jul 17, 2025 | A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb,… |
| CVE-2024-39835 | High (7.8) | 0.18% | — | Jul 17, 2025 | A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the… |
| CVE-2024-39289 | High (7.8) | 0.18% | — | Jul 17, 2025 | A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval()… |
| CVE-2024-39780 | Critical (9.8) | 0.39% | — | Apr 2, 2025 | A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS… |
| CVE-2024-44856 | High (7.5) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_smac_planner(). |
| CVE-2024-44855 | High (7.5) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_navfn_planner(). |
| CVE-2024-44854 | High (7.5) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component smoothPlan(). |
| CVE-2024-44853 | High (7.5) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component computeControl(). |
| CVE-2024-44852 | Critical (9.8) | 0.60% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar::isUnsafeToPlan(). |
| CVE-2024-41650 | Critical (9.8) | 0.48% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_costmap_2d. |
| CVE-2024-41649 | Critical (9.8) | 0.70% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the executor_thread_. |
| CVE-2024-41648 | Critical (9.8) | 0.48% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller. |
| CVE-2024-41647 | Critical (9.8) | 0.70% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_mppi_controller. |
| CVE-2024-41646 | Critical (9.8) | 0.70% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_dwb_controller. |
| CVE-2024-41645 | Critical (9.8) | 0.70% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl. |
| CVE-2024-41644 | Critical (9.8) | 0.70% | — | Dec 6, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the dyn_param_handler_ component. |
| CVE-2024-38927 | Critical (9.8) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change… |
| CVE-2024-38926 | Critical (9.8) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change… |
| CVE-2024-38925 | Critical (9.8) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change… |
| CVE-2024-38924 | Critical (9.8) | 0.55% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change… |
| CVE-2024-38923 | Critical (9.8) | 0.55% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change… |
| CVE-2024-38922 | Critical (9.8) | 0.59% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component… |
| CVE-2024-38921 | Critical (9.8) | 0.60% | — | Dec 6, 2024 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change… |
| CVE-2024-30962 | High (7.8) | 0.29% | — | Dec 5, 2024 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the nav2_amcl process |
| CVE-2024-30961 | High (7.8) | 0.29% | — | Dec 5, 2024 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the error-thrown mechanism in… |
| CVE-2024-25199 | High (8.1) | 0.58% | — | Feb 20, 2024 | Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads to a use-after-free. |
| CVE-2024-25198 | Critical (9.1) | 0.71% | — | Feb 20, 2024 | Inappropriate pointer order of laser_scan_filter_.reset() and tf_listener_.reset() (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions leads to a use-after-free. |
| CVE-2024-25197 | Medium (6.5) | 0.68% | — | Feb 20, 2024 | Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a NULL pointer dereference via the isCurrent() function at /src/layered_costmap.cpp. |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.