vulnwire
8.8high

CVE-2017-56711 exploit

Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 hav…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 73%
Public exploits
1
Exploit-DB

Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file.

Exploit prediction (EPSS)

1.40% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

Exploits and detections

  • EDB-41754 Intermec PM43 Industrial Printer - Local Privilege Escalation · local · 2017-03-28

CVSS scores

Assigned byVersionScoreVector
NVD3.08.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

  • exploit-db.com /exploits/41754/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • apps.intermec.com /downloads/eps_download/Firmware%20Release%20Notes%20x10_11_013310.pdf · x_refsource_CONFIRM, x_transferred
  • akerva.com /blog/intermec-industrial-printers-local-root-with-busybox-jailbreak/ · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/97236 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /kmkz/exploit/blob/master/CVE-2017-5671-Credits.pdf · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.