A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker t…

published 2017-03-14 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15572

cvss: 6.7; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 5.3%; EPSS 5.3% chance of exploitation in 30 days, percentile 92%
public exploits: 2; Metasploit, Exploit-DB

A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.

Timeline

2016-09-23 First public exploit (Metasploit exploit/multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc)
2017-03-14 Published

Exploit prediction

5.29% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc MagniComp SysInfo mcsiwrapper Privilege Escalation metasploit exploit, excellent rank, 2016-09-23
EDB-44150 MagniComp SysInfo - mcsiwrapper Privilege Escalation (Metasploit) local, 2018-02-20

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.7	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-20 Improper Input Validation

References

exploit-db.com /exploits/44150/
exploit
magnicomp.com /support/cve/CVE-2017-6516.shtml
third-party-advisory
labs.mwrinfosecurity.com /advisories/multiple-vulnerabilities-in-magnicomps-sysinfo-root-setuid/
third-party-advisory
labs.mwrinfosecurity.com /advisories/magnicomps-sysinfo-root-setuid-local-privilege-escalation-vulnerability/
third-party-advisory
securityfocus.com /bid/96934
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-6516
NVD CVE-2017-6516

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary