Skip to content
CVE-2026-124747: BusyBox FTP Vulnerability Exposes Systems to Remote Code Execution

CVE-2026-124747: BusyBox FTP Vulnerability Exposes Systems to Remote Code Execution

First seen 11 Nov 2026, 02:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 02:19 UTC
  • •CVE-2026-124747 affects BusyBox's wget utility during FTP download resumption.
  • •Exploitation requires interaction with a compromised FTP server or an on-path attacker.
  • •Mitigation includes applying patches and disabling FTP resume functionality.

A flaw (CVE-2026-124747) was identified in BusyBox affecting the wget utility during FTP download resumption. The vulnerability allows a malicious FTP server to manipulate file size metadata, leading to a heap-based buffer overflow. Successful exploitation could enable arbitrary code execution or cause application crashes, resulting in denial of service. Systems using BusyBox in embedded or containerized environments are particularly at risk, especially if they resume downloads from untrusted sources. Red Hat has assessed the flaw as having Important severity due to the specific conditions required for exploitation. Mitigation strategies include applying vendor patches and disabling FTP resume functionality until a fix is available. The vulnerability was published on November 10, 2026, and is currently not listed in the CISA KEV catalog.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 11h ago How this analysis works

Timeline

2026-11-10
CVE-2026-124747 published
The vulnerability was disclosed, highlighting risks associated with BusyBox's wget utility during FTP operations.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track Red Hat and CVE-2026-124747 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What systems are affected by CVE-2026-124747?
Systems using BusyBox in embedded, appliance, container, or hardened-image deployments are affected.
What steps should I take to mitigate this vulnerability?
Apply the vendor's fixed package update as soon as available and disable FTP resume until patched.
Is there any active exploitation of this vulnerability?
Currently, there is no confirmed active exploitation reported for CVE-2026-124747.