Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-14187. PoCs published by 0xSIGILL.
AI-analyzed exploit summary This PoC exploits CVE-2017-14187, a local privilege escalation vulnerability in FortiOS, by leveraging LD_PRELOAD injection via the fnsysctl command to execute arbitrary code and spawn a root shell. The exploit requires physical access to a USB drive and system_admin credentials.
Description
A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via linking the aforementioned binary program to a command that is allowed to be run by the fnsysctl CLI command.
Exploits (1)
This PoC exploits CVE-2017-14187, a local privilege escalation vulnerability in FortiOS, by leveraging LD_PRELOAD injection via the fnsysctl command to execute arbitrary code and spawn a root shell. The exploit requires physical access to a USB drive and system_admin credentials.
References (3)
Scores
CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H