CVE-2025-60876

BusyBox wget is a lightweight “download a file from the web” tool used in many embedded and Linux-based environments. This bug is like letting someone smuggle newline characters inside a web address so the downloader accidentally “types” extra lines—extra HTTP headers—into the request it sends. That could cause the remote side (or systems that rely on those requests) to behave differently than you expect.

This matters if your systems use BusyBox wget from BusyBox (including Red OS environments that include/ship BusyBox) and that tool is used to fetch web content. The risk is network-driven and does not require a victim login or clicking; however, the findings don’t confirm whether the bug is reachable in your default setup. Treat it as relevant when you download URLs that an attacker could influence (for example, URLs coming from external inputs, webhooks, or untrusted configuration).

This is an Amber issue: it’s a real network-facing weakness in BusyBox wget (through 1.3.7), but there’s no confirmed public exploit code on record and the exact “default reachability” is not yet known in the findings. Still, because it enables attacker-controlled header injection, you should upgrade the affected BusyBox wget versions promptly as part of your next maintenance window, sooner if attackers can influence the URLs being fetched.