EIP-2026-101832
PRE-CVELifeSize Room 5.0.9 - Multiple Vulnerabilities
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-101832. PoCs published by Xiphos Research Ltd.
AI-analyzed exploit summary This exploit leverages an unauthenticated command injection vulnerability in LifeSize Room 5.0.9 via the LsSystemRestore.sh script to disclose admin credentials, then uses those credentials to execute arbitrary commands via the doPrefCommand method in the LSRoom_Remoting endpoint. Local privilege escalation to root is achieved by exploiting a PATH-based setuid binary (tcpdump_manager).
Description
LifeSize Room 5.0.9 - Multiple Vulnerabilities
Exploits (1)
This exploit leverages an unauthenticated command injection vulnerability in LifeSize Room 5.0.9 via the LsSystemRestore.sh script to disclose admin credentials, then uses those credentials to execute arbitrary commands via the doPrefCommand method in the LSRoom_Remoting endpoint. Local privilege escalation to root is achieved by exploiting a PATH-based setuid binary (tcpdump_manager).