CVE-2023-43608 Supply chain in Buildroot

High 8.1 Published 5 Dec 2023 Updated 4 Nov 2025

A man-in-the-middle attack can exploit disabled hash checks in Buildroot to execute arbitrary commands on the builder.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-43608?

CVE-2023-43608 is a high-severity vulnerability in Buildroot, published on 5 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.

Weakness: CWE-494

Which versions are affected by CVE-2023-43608?

It affects 1 product.

Products include Buildroot Buildroot.

How do I fix CVE-2023-43608?

No fix has been published for CVE-2023-43608 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-43608 being exploited?

There is no known exploitation of CVE-2023-43608 in the wild and no public exploit code.

Sources

Also known as GHSA-f58h-8g6h-hwcr.