CVE-2017-16544: busybox Code Injection
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2017-16544UBUNTU-CVE-2017-16544DEBIAN-CVE-2017-16544
Published 20-11-2017Last modified 09-06-2025
Vulnerability summary
CVE-2017-16544 is a high (CVSS 8.8) Code Injection vulnerability in busybox. EPSS estimates a 6.14% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities. 13 public exploits are recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
6.14%
0%100%
Low · -0.10 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits13reference
Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 20-11-2017PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
CVSS metrics
7 scores · 5 sources · 3 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 8.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
6.14%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
-0.10 pp
From 6.24% on 18-09-2026
18-09-202618-10-2026
EPSS score6.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
13 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Show all 13 exploits
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- busybox< 1:1.27.2-2
- debian_linuxEOL8.0 | 9.0
Alpine1 product
- busybox< 1.27.2-r4 | < 1.24.2-r2 | < 1.24.2-r13 | < 1.25.1-r1 | < 1.26.2-r9
Busybox1 product
- busybox≤ 1.27.2
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04
Ubuntu1 product
- busybox< 1:1.21.0-1ubuntu1.4 | < 1:1.22.0-15ubuntu1.4 | < 1:1.27.2-1ubuntu4
Vmware1 product
- esxiEOL6.0 | 6.0:1 | 6.0:1a | 6.0:1b | 6.0:2 | 6.0:3 | 6.0:3a | 6.0:600-201504401 | 6.0:600-201505401 | 6.0:600-201507101 | 6.0:600-201507102 | 6.0:600-201507401 | 6.0:600-201507402 | 6.0:600-201507403 | 6.0:600-201507404 | 6.0:600-201507405 | 6.0:600-201507406 | 6.0:600-201507407 | 6.0:600-201509101 | 6.0:600-201509102 | 6.0:600-201509201 | 6.0:600-201509202 | 6.0:600-201509203 | 6.0:600-201509204 | 6.0:600-201509205 | 6.0:600-201509206 | 6.0:600-201509207 | 6.0:600-201509208 | 6.0:600-201509209 | 6.0:600-201509210 | 6.0:600-201510401 | 6.0:600-201511401 | 6.0:600-201601101 | 6.0:600-201601102 | 6.0:600-201601401 | 6.0:600-201601402 | 6.0:600-201601403 | 6.0:600-201601404 | 6.0:600-201601405 | 6.0:600-201602401 | 6.0:600-201603101 | 6.0:600-201603102 | 6.0:600-201603201 | 6.0:600-201603202 | 6.0:600-201603203 | 6.0:600-201603204 | 6.0:600-201603205 | 6.0:600-201603206 | 6.0:600-201603207 | 6.0:600-201603208 | 6.0:600-201605401 | 6.0:600-201608101 | 6.0:600-201608401 | 6.0:600-201608402 | 6.0:600-201608403 | 6.0:600-201608404 | 6.0:600-201608405 | 6.0:600-201610410 | 6.0:600-201611401 | 6.0:600-201611402 | 6.0:600-201611403 | 6.0:600-201702101 | 6.0:600-201702102 | 6.0:600-201702201 | 6.0:600-201702202 | 6.0:600-201702203 | 6.0:600-201702204 | 6.0:600-201702205 | 6.0:600-201702206 | 6.0:600-201702207 | 6.0:600-201702208 | 6.0:600-201702209 | 6.0:600-201702210 | 6.0:600-201702211 | 6.0:600-201702212 | 6.0:600-201703401 | 6.0:600-201706101 | 6.0:600-201706102 | 6.0:600-201706103 | 6.0:600-201706401 | 6.0:600-201706402 | 6.0:600-201706403 | 6.0:600-201710301 | 6.0:600-201811001 | 6.0:600-201811401 | 6.0:600-201903001 | 6.0:600-201905001 | 6.0:600-201909001 | 6.5 | 6.5:650-201701001 | 6.5:650-201703001 | 6.5:650-201703002 | 6.5:650-201704001 | 6.5:650-201707101 | 6.5:650-201707102 | 6.5:650-201707103 | 6.5:650-201707201 | 6.5:650-201707202 | 6.5:650-201707203 | 6.5:650-201707204 | 6.5:650-201707205 | 6.5:650-201707206 | 6.5:650-201707207 | 6.5:650-201707208 | 6.5:650-201707209 | 6.5:650-201707210 | 6.5:650-201707211 | 6.5:650-201707212 | 6.5:650-201707213 | 6.5:650-201707214 | 6.5:650-201707215 | 6.5:650-201707216 | 6.5:650-201707217 | 6.5:650-201707218 | 6.5:650-201707219 | 6.5:650-201707220 | 6.5:650-201707221 | 6.5:650-201710001 | 6.5:650-201712001 | 6.5:650-201803001 | 6.5:650-201806001 | 6.5:650-201808001 | 6.5:650-201810001 | 6.5:650-201810002 | 6.5:650-201811001 | 6.5:650-201811002 | 6.5:650-201811301 | 6.5:650-201901001 | 6.5:650-201903001 | 6.5:650-201905001 | 6.7 | 6.7:670-201806001 | 6.7:670-201807001 | 6.7:670-201808001 | 6.7:670-201810001 | 6.7:670-201810101 | 6.7:670-201810102 | 6.7:670-201810103 | 6.7:670-201810201 | 6.7:670-201810202 | 6.7:670-201810203 | 6.7:670-201810204 | 6.7:670-201810205 | 6.7:670-201810206 | 6.7:670-201810207 | 6.7:670-201810208 | 6.7:670-201810209 | 6.7:670-201810210 | 6.7:670-201810211 | 6.7:670-201810212 | 6.7:670-201810213 | 6.7:670-201810214 | 6.7:670-201810215 | 6.7:670-201810216 | 6.7:670-201810217 | 6.7:670-201810218 | 6.7:670-201810219 | 6.7:670-201810220 | 6.7:670-201810221 | 6.7:670-201810222 | 6.7:670-201810223 | 6.7:670-201810224 | 6.7:670-201810225 | 6.7:670-201810226 | 6.7:670-201810227 | 6.7:670-201810228 | 6.7:670-201810229 | 6.7:670-201810230 | 6.7:670-201810231 | 6.7:670-201810232 | 6.7:670-201810233 | 6.7:670-201810234 | 6.7:670-201811001 | 6.7:670-201901001 | 6.7:670-201901401 | 6.7:670-201901402 | 6.7:670-201901403 | 6.7:670-201903001 | 6.7:670-201904001
6 vendors · 7 products
References
25 links- www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/X Refsource MISCThird Party AdvisoryREPORT
lists.debian.org/debian-lts-announce/2018/07/msg00037.htmlMailing ListX Refsource MLISTThird Party Advisory- git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8X Refsource MISCPatchVendor Advisory
- packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
Show all 25 references
- packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
us-cert.cisa.gov/ics/advisories/icsa-20-240-01X Refsource MISCThird Party AdvisoryUS Government Resource- lists.debian.org/debian-lts-announce/2021/02/msg00020.htmlMailing ListX Refsource MLISTThird Party Advisory