CVE-2015-8612

HIGH

Blueman <2.0.3 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2015-8612. PoCs published by Metasploit, Sebastian Krahmer, bcoles, including Metasploit module exploits/linux/local/blueman_set_dhcp_handler_dbus_priv_esc.

AI-analyzed exploit summary This Metasploit module exploits a Python code injection vulnerability in blueman (CVE-2015-8612) via the `set_dhcp_handler` D-Bus function, which uses unsanitized user input in an `eval` call, leading to arbitrary command execution as root.

Description

The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubylocallinux

https://www.exploit-db.com/exploits/46186

View Code ZIP pw:eip

This Metasploit module exploits a Python code injection vulnerability in blueman (CVE-2015-8612) via the `set_dhcp_handler` D-Bus function, which uses unsanitized user input in an `eval` call, leading to arbitrary command execution as root.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: blueman < 2.0.3

No auth needed

Prerequisites: dbus-send installed · blueman service running · D-Bus access to org.blueman.Mechanism

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548.003 - Sudo and Sudo Caching

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC EXCELLENT

by Sebastian Krahmer, bcoles · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/blueman_set_dhcp_handler_dbus_priv_esc.rb