CVE-2017-16544: Busybox

High severity, CVSS 8.8. EPSS: 6.2% chance of exploitation in the next 30 days.

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

Affected products

• Busybox Busybox: up to and including 1.27.2
• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Redlion N-Tron 702-W Firmware: any version
• Redlion N-Tron 702m12-W Firmware: any version
• VMware ESXi: version 6.0 only; version 6.5 only; version 6.7 only

Published 2017-11-20. Last modified 2026-06-17.