Is CVE-2025-60876 actively exploited?

No active exploitation of CVE-2025-60876 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-60876 be exploited remotely?

Yes. CVE-2025-60876 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-60876?

CVE-2025-60876 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2025-60876

MEDIUM

CVE-2025-60876

CWE-284Published: November 10, 2025· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

NVD Source

Technical Analysis

CVE-2025-60876 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Vendors & Products

busybox1 product(s)

busybox

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092

News & Research Mentioning CVE-2025-60876

Siemens SINEC OS

CISA Alerts· Jul 7, 2026

View CSAF Summary SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/ cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but t [xlite_meta score:73 src:CISA Alerts xlite_fp:c21152d4d475a8e030213da473dfe64f022ad052db21f63751c61a376d2d7ec4]