High severity · published Jul 17, 2025
CVE-2024-39289
Unsafe use of eval() method in rosparam tool
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Robot Operating System (ROS) · Open Source Robotics Foundation
Noetic Ninjemys; Melodic Morenia; Kinetic Kame; Indigo Igloo · source: vendor
RO
Robot Operating System · Openrobotics
indigo_igloo; kinetic_kame; melodic_morenia; noetic_ninjemys · source: NVD
Affected product
RO
Robot Operating System (ROS)
Open Source Robotics Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39289
Product
https://www.ros.org/blog/noetic-eol/
More from Robot Operating System (ROS)
9.8
CVE-2024-39780
Use of unsafe yaml load in dynparam
7.8
CVE-2025-3753
Unsafe use of eval() method in rosbag tool
7.8
CVE-2024-41921
Unsafe use of eval() method in rostopic echo tool
7.8
CVE-2024-41148
Unsafe use of eval() method in rostopic hz tool
7.8
CVE-2024-39835
Unsafe use of eval() method in roslaunch tool