CVE-2018-1000500 is a missing-certificate-validation flaw (CWE-295) in the "busybox wget" applet shipped by BusyBox before version 1.32.0: when fetching a URL over HTTPS, wget did not check that the server's TLS certificate was valid or matched the requested host, so a man-in-the-middle could impersonate the download server and hand back attacker-controlled data — including binaries — without triggering any warning; NVD's own analysis rates this CVSS v3.1 8.1 (high).
Vulnerability summary
8.1
High
2.5%
EPSS score (FIRST)
No
CISA KEV catalog
2018-06-26
Published
Vulnerability ID: CVE-2018-1000500 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| BusyBox (wget applet) | cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:* | BusyBox before 1.32.0 (fixed in 1.32.0) |
What does this mean for affected devices?
CVE-2018-1000500 (CWE-295, improper certificate validation) affects BusyBox, the single-binary suite of Unix utilities that underpins most embedded Linux firmware, routers, IoT devices and minimal container images. NVD's description states: "Busybox contains a Missing SSL certificate validation vulnerability in The 'busybox wget' applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using 'busybox wget https://compromised-domain.com/important-file'" (NVD).
NVD's own analysis gives this a Primary CVSS v3.1 score of 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable with high attack complexity (an attacker must be positioned to intercept the connection), no privileges or user interaction required, and full impact to confidentiality, integrity and availability because a spoofed HTTPS response can deliver arbitrary attacker content. NVD separately lists a legacy CVSS v2 Primary score of 6.8 (NVD).
The issue surfaced on the BusyBox mailing list in May 2018 when a contributor submitted a patch titled "wget: don't silently ignore certificate validation," and was initially contentious: maintainer Denys Vlasenko rejected the first patch as breaking common build-script use cases ("wget should work for common use cases... Your patch breaks that"), while other contributors argued that silently skipping certificate checks made HTTPS support "totally useless" against man-in-the-middle attacks with a fake certificate (BusyBox mailing list, May 2018). The project ultimately shipped certificate validation for wget's HTTPS downloads, fixed in BusyBox 1.32.0.
Canonical's Ubuntu Security Notice USN-4531-1 confirms the practical impact: "It was discovered that the BusyBox wget applet incorrectly validated SSL certificates. A remote attacker could possibly use this issue to intercept secure communications," and lists fixed busybox/busybox-initramfs/busybox-static packages for Ubuntu 18.04 LTS and 20.04 LTS (Ubuntu USN-4531-1).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.02487 (84.698th percentile) as of 2026-11-06 — a meaningfully elevated score for a 2018-era issue, reflecting how widely BusyBox's wget is still embedded in firmware update and provisioning scripts (CISA KEV, FIRST EPSS).
Devices and build pipelines that invoke busybox wget to fetch firmware images, packages or configuration over HTTPS should be updated to BusyBox 1.32.0 or later; where that is not possible, downloads should be independently verified (for example with a detached signature) rather than relying on wget's own TLS handshake.
Evidence
- The busybox wget applet contained a missing-SSL-certificate-validation vulnerability (CWE-295) allowing man-in-the-middle delivery of arbitrary content over a "secure" HTTPS download. — NVD
- NVD's own Primary analysis scores this CVSS v3.1 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; a legacy CVSS v2 Primary score of 6.8 is also recorded. — NVD
- The fix was proposed and debated on the BusyBox mailing list in May 2018 as a patch to stop wget from silently ignoring HTTPS certificate validation; fixed in BusyBox 1.32.0. — BusyBox mailing list
- Ubuntu Security Notice USN-4531-1 confirms the BusyBox wget applet incorrectly validated SSL certificates, letting a remote attacker intercept secure communications, and lists fixed package versions for Ubuntu 18.04 LTS and 20.04 LTS. — Ubuntu USN-4531-1
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.02487 (84.698th percentile) as of 2026-11-06. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
Does CVE-2018-1000500 mean every use of busybox wget over HTTPS was unsafe?
Yes for BusyBox versions before 1.32.0 — wget's HTTPS mode downloaded content without validating the server's TLS certificate, so a network attacker able to intercept the connection could impersonate the server and supply unverified content, per NVD.
Why was the fix for CVE-2018-1000500 initially rejected by a BusyBox maintainer?
Maintainer Denys Vlasenko rejected the first patch, arguing it would break common build-script use cases such as downloading kernel or compiler sources without modifying existing scripts; other contributors pushed back that skipping certificate validation made HTTPS effectively useless against man-in-the-middle attacks, per the BusyBox mailing list thread.
What CVSS score did NVD assign to CVE-2018-1000500 and why is it 'high' rather than 'critical'?
NVD's Primary analysis scores it CVSS v3.1 8.1 (high) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — the High attack complexity (AC:H) reflects that an attacker must already be positioned to intercept the victim's network traffic, which keeps the score just below the critical band despite full confidentiality, integrity and availability impact, per NVD.
Which BusyBox version fixes CVE-2018-1000500?
The fix shipped in BusyBox 1.32.0, after which wget validates the HTTPS server's certificate by default; Ubuntu backported the fix into the busybox, busybox-initramfs and busybox-static packages for 18.04 LTS and 20.04 LTS, per Ubuntu USN-4531-1.