EIP-2026-114731

This exploit leverages a temporary file vulnerability in Solaris 2.5.1's lpNet and HP JetAdmin software to escalate privileges from a remote user to root. It abuses symlinks and world-writable temporary files to manipulate .rhosts files, enabling password-less root access via rsh.