CVE-2018-1000500: busybox Improper Certificate Validation
CVSS: 8.1v3.1HighModified
AliasesALPINE-CVE-2018-1000500MGASA-2021-0009UBUNTU-CVE-2018-1000500USN-4531-1DEBIAN-CVE-2018-1000500
Published 26-06-2018Last modified 09-06-2025
Vulnerability summary
CVE-2018-1000500 is a high (CVSS 8.1) Improper Certificate Validation vulnerability in busybox. EPSS estimates a 2.49% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
2.49%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 26-06-2018PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
CVSS metrics
7 scores · 5 sources · 3 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSources5 sources · 6.5–8.1
- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High 8.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.49%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
+0.03 pp
From 2.46% on 18-09-2026
18-09-202618-10-2026
EPSS score2.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- busybox< 1.28.3-r2
Busybox1 product
- busybox< 1.32.0
Debian1 product
- busyboxAll versions (No fix recorded)
Mageia1 product
- busybox< 1.30.1-1.1.mga7
Ubuntu1 product
- busybox< 1:1.27.2-2ubuntu3.3 | < 1:1.30.1-4ubuntu6.2
5 vendors · 5 products
References
12 links- lists.busybox.net/pipermail/busybox/2018-May/086462.htmlX Refsource MISCMailing ListVendor AdvisoryREPORT
- git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91X Refsource CONFIRMPatchVendor Advisory
