EIP-2026-101832

This exploit leverages an unauthenticated command injection vulnerability in LifeSize Room 5.0.9 via the LsSystemRestore.sh script to disclose admin credentials, then uses those credentials to execute arbitrary commands via the doPrefCommand method in the LSRoom_Remoting endpoint. Local privilege escalation to root is achieved by exploiting a PATH-based setuid binary (tcpdump_manager).