EIP-2026-103004

The exploit leverages a symbolic link vulnerability in netconfig, which insecurely creates /tmp/tmpmsg. An attacker can create a symlink to a critical file (e.g., /etc/passwd) and wait for root to execute netconfig, resulting in file overwrites with predictable permissions.