EulerOS 2.0 SP12 : busybox (EulerOS-SA-2026-2581)

high Nessus Plugin ID 326198

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the busybox packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request- target (path/query), allowing the request line to be split and attacker-controlled headers to be injected.
To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).(CVE-2025-60876)

BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option.
Attackers can exploit incorrect heap buffer allocation calculations in the option_to_env() function to cause denial of service or achieve arbitrary code execution on embedded systems without heap hardening.(CVE-2026-29004)

Tenable has extracted the preceding description block directly from the EulerOS busybox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected busybox packages.

Plugin Details

Severity: High

ID: 326198

File Name: EulerOS_SA-2026-2581.nasl

Version: 1.1

Type: Local

Family: Huawei Local Security Checks

Published: 7/10/2026

Updated: 7/10/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-29004

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2025-60876

CVSS v4

Risk Factor: High

Base Score: 7.2

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: p-cpe:/a:huawei:euleros:busybox, p-cpe:/a:huawei:euleros:busybox-help, cpe:/o:huawei:euleros:2.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/10/2026

Vulnerability Publication Date: 11/10/2025

Reference Information

CVE: CVE-2025-60876, CVE-2026-29004

Detections

Analytics