CVE-2001-1000

Merit AAA Server <5.01 - Info Disclosure

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2001-1000. PoCs published by Digital Shadow.

AI-analyzed exploit summary This exploit leverages a symbolic link vulnerability in the setuid root 'rlmadmin' utility of the Merit AAA RADIUS Server to read arbitrary files (e.g., /etc/shadow) by manipulating the 'rlmadmin.help' file. It creates a temporary directory, symlinks the target file, and invokes rlmadmin to disclose the file contents.

Description

rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files via a symlink attack on the rlmadmin.help file.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Digital Shadow · bashlocalunix

https://www.exploit-db.com/exploits/21101

View Code ZIP pw:eip

This exploit leverages a symbolic link vulnerability in the setuid root 'rlmadmin' utility of the Merit AAA RADIUS Server to read arbitrary files (e.g., /etc/shadow) by manipulating the 'rlmadmin.help' file. It creates a temporary directory, symlinks the target file, and invokes rlmadmin to disclose the file contents.

Classification

Working Poc 100%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Merit AAA RADIUS Server (rlmadmin utility)

No auth needed

Prerequisites: Local access to the system · Presence of vulnerable Merit AAA RADIUS Server with setuid rlmadmin

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1200 - Hardware Additions

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/7096

Exploit, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/3302

Exploit, Vendor Advisory mailing-list x_refsource_bugtraq

http://archives.neohapsis.com/archives/bugtraq/2001-09/0036.html

Scores

EPSS 0.0085

EPSS Percentile 53.2%

Details

Status published

Products (2)

merit/aaa_radius_server 3.8m

merit/aaa_radius_server 5.01

Published Sep 07, 2001

Tracked Since Feb 18, 2026