CVE-2025-60876

BusyBox wget is a lightweight “download a file from the web” tool used in many embedded and Linux-based environments. This bug is like letting someone smuggle newline characters inside a web address so the downloader accidentally “types” extra lines—extra HTTP headers—into the request it sends. That could cause the remote side (or systems that rely on those requests) to behave differently than you expect.

This matters if your systems use BusyBox wget from BusyBox (including Red OS environments that include/ship BusyBox) and that tool is used to fetch web content. The risk is network-driven and does not require a victim login or clicking; however, the findings don’t confirm whether the bug is reachable in your default setup. Treat it as relevant when you download URLs that an attacker could influence (for example, URLs coming from external inputs, webhooks, or untrusted configuration).

This is an Amber issue: it’s a real network-facing weakness in BusyBox wget (through 1.3.7), but there’s no confirmed public exploit code on record and the exact “default reachability” is not yet known in the findings. Still, because it enables attacker-controlled header injection, you should upgrade the affected BusyBox wget versions promptly as part of your next maintenance window, sooner if attackers can influence the URLs being fetched.

Confirm exposure (what to check)

1. On each server/device that runs the vulnerable component, identify the BusyBox version and specifically the wget component version (BusyBox often bundles wget).
2. Determine whether wget is actually used in your environment (startup scripts, cron jobs, update/check scripts, device provisioning).
3. Identify where the URL comes from:
   • Is it hardcoded in scripts/configs?
   • Is it assembled from user input, HTTP parameters, emails/webhooks, message queues, or any other untrusted source?
   • If an attacker can influence the URL path/query, the injected-header risk is materially higher.

Upgrade path (the fix)

• Update BusyBox to V4.0 or later.
• After upgrading, re-test the workflows that use BusyBox wget (normal downloads/updates).

Branches / fixed versions

• The findings only state: update to V4.0 or later; they do not list separate minor branches.

Workarounds if you can’t patch immediately

• Reduce or eliminate attacker control over URLs given to BusyBox wget (e.g., only allow hardcoded/approved domains and fixed paths; block dynamic URL input from external users).
• Where practical, avoid using BusyBox wget on paths/queries that could include untrusted characters.

What to monitor

• Configuration/script changes that introduce dynamic URL construction.
• Download failures or unusual HTTP request behavior from systems using BusyBox wget, especially after integrating new automation.

Timing

• KEV: not listed in CISA KEV for this item.
• A specific CISA due date is not provided in the findings, so follow your normal patch SLA, prioritizing systems where URLs can be influenced by untrusted parties.

Severity and status

• Verdict: AMBER.
• Weakness type: CWE-284 (Improper Neutralization of Special Elements used in an Injection).
• Exploitation status in findings: no public exploit code on record; no KEV listing.

Mechanism (how it’s triggered)

• BusyBox wget through version 1.3.7 accepted raw CR (0x0D) / LF (0x0A) and other C0 control bytes in the HTTP request-target (the URL path/query).
• This allows request-line splitting, which can inject attacker-controlled HTTP headers into the outgoing request.
• The technical backstop notes that raw spaces (0x20) should also be rejected for correctness; clients should use %20.

Attack vector and prerequisites

• Attack vector: Network.
• Authentication required: None.
• User interaction: None.
• The findings do not confirm whether it is reachable in default configurations, so practical exposure depends on whether your BusyBox wget usage is reachable and whether an attacker can supply/manipulate the URL path/query.

Exploitability indicators

• EPSS is present as a prediction in the findings but, per the provided guidance, it should not be treated as confirmed exploitation.
• Exploit maturity appears low based on the absence of public exploit code in the findings.

Note on “KEV”

• KEV (CISA Known Exploited Vulnerabilities) is a list of vulnerabilities known to be exploited in the wild; this one is not listed in the provided KEV findings.