CVE-2011-2716: Busybox

Medium severity, CVSS 6.8. EPSS: 1.8% chance of exploitation in the next 30 days.

The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.

Affected products

• Busybox Busybox: up to and including 1.19.4; version 0.60.5 only; version 1.00 only; version 1.0.0 only; version 1.01 only; version 1.1.0 only; …
• T-Mobile TM-AC1900: version 3.0.0.4.376_3169 only

Published 2012-07-03. Last modified 2026-06-16.