CVE-2018-14327

HIGH

Alcatel OSPREY3_MINI - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-14327. PoCs published by Osanda Malith Jayathissa.

AI-analyzed exploit summary This exploit demonstrates a local privilege escalation vulnerability in EE 4GEE Mini EE40_00_02.00_44 due to weak folder permissions and an unquoted service path. The PoC shows how an attacker can replace the executable in the vulnerable directory to achieve escalation.

Description

The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 sets weak permissions (Everyone:Full Control) for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain privileges, as demonstrated by inserting a Trojan horse ServiceManager.exe file into the "Web Connecton\EE40\BackgroundService" directory.

Exploits (1)

exploitdb WORKING POC

by Osanda Malith Jayathissa · textlocalwindows

https://www.exploit-db.com/exploits/45501

View Code ZIP pw:eip

This exploit demonstrates a local privilege escalation vulnerability in EE 4GEE Mini EE40_00_02.00_44 due to weak folder permissions and an unquoted service path. The PoC shows how an attacker can replace the executable in the vulnerable directory to achieve escalation.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Trivial

Reliability

Reliable

Target: EE 4GEE Mini EE40_00_02.00_44

Auth required

Prerequisites: Local access to the system · Ability to write to the vulnerable directory

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548.002 - Bypass User Account Control

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Core References

Exploit, Patch x_refsource_misc

http://blog.zerodaylab.com/2018/09/zerodaylab-discovers-ee-unquoted.html

Exploit, Patch, Technical Description, Third Party Advisory x_refsource_misc

https://osandamalith.com/2018/09/17/ee-4gee-mini-local-privilege-escalation-vulnerability-cve-2018-14327/

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/45501/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105385

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/149492/EE-4GEE-Mini-Local-Privilege-Escalation.html

Scores

CVSS v3 7.8

EPSS 0.0439

EPSS Percentile 90.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-732

Status published

Products (1)

ee/ee40vb_firmware < ee40_00_02.00_45

Published Sep 26, 2018

Tracked Since Feb 18, 2026