A critical code execution vulnerability in the ROS rosparam tool allows attackers to execute arbitrary Python code, posing a severe risk to robotic systems.

This is an eval injection flaw (CWE-95) where the rosparam tool processes unsanitized parameter values via special converters for angle representations. The vulnerability can be triggered by an attacker providing malicious input, requiring local access and user interaction.

Successful exploitation allows an attacker to execute arbitrary Python code with the privileges of the ROS process. Given the role of ROS in controlling robotic hardware, this could lead to full system compromise, unauthorized physical movement, or the theft of sensitive operational data. With a CVSS score of 7.8, this vulnerability represents a high-severity risk that demands immediate attention for any remaining ROS 1 deployments.

Immediate Action: Migrate all systems currently running ROS 1 to a supported ROS 2 distribution, as ROS 1 has reached its end of life and will not receive further security patches.

Proactive Monitoring: Review system logs for unusual parameter modification attempts or unexpected execution of Python scripts within the ROS environment.

Compensating Controls: Restrict access to the ROS network and parameter server to authorized users only, and implement strict input validation for any user-supplied data passed to rosparam.

Public Exploit Available: False

The vulnerability is significant due to the potential for full code execution within robotic control systems. Because ROS 1 is no longer supported by the vendor, patching is not a viable long-term solution. Organizations must prioritize the migration to ROS 2 to eliminate this risk entirely and ensure ongoing security support for their infrastructure.