A vulnerability exists in the BusyBox httpd applet's Basic Authentication password verification logic in networking/httpd.c. The code uses if (passwd[0] == '$' && isdigit(passwd[1])) to distinguish hashed passwords from plaintext. Yescrypt hashes begin with $y$, and because 'y' does not satisfy isdigit(), the detection logic fails. The code falls through to the plaintext strcmp branch, making the stored hash string itself the "password."

Supplying the literal hash string as the password results in HTTP 200, while the actual plaintext password is rejected with HTTP 401. Exploitation requires the attacker to first obtain the hash string from httpd.conf.