CVE-2026-88834

3.7Low

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

3.7Low

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-203

Impact

Remote attackers can enumerate valid usernames by analyzing authentication error responses against the HTTP server. They only need network access to BusyBox httpd configured with system password authentication.

Root cause

The authentication failure handling exhibits an observable timing or response discrepancy (user existence oracle) when querying non-standard password configurations.

Affected systems

BusyBox httpd (specific version ranges are not listed in the advisory).

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Specific fixed versions are not listed yet; mitigate by switching to default builds with shadow password support or disabling system password authentication on httpd.

shell

$ busybox httpd -h

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-88834