Skip to content
Fencer Vulns
high 7.8

CVE-2023-26604 json

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in whic…

published 2023-03-03 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-30399

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • systemd Debian 14, Debian 13, Debian 12 247.1-2

debian advisories DEBIAN-CVE-2023-26604

  • systemd RHEL 8 239-74.el8_8.2
  • systemd-pam RHEL 8 239-74.el8_8.2
  • systemd-libs RHEL 8 239-74.el8_8.2
  • systemd-udev RHEL 8 239-74.el8_8.2
  • systemd-tests RHEL 8 239-74.el8_8.2
  • systemd-container RHEL 8 239-74.el8_8.2
  • systemd-journal-remote RHEL 8 239-74.el8_8.2
  • systemd RHEL 7 ELS 219-78.el7_9.11

red hat advisories RHSA-2024:7705RHSA-2024:1105RHSA-2023:3837

  • systemd SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 246.16-150300.7.60.1
  • systemd SLES for SAP 12 SP4, SLES 12 SP4-LTSS, SLES 12 SP4-ESPOS +3 more 228-150.108.2
  • systemd SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 228-157.52.1

suse advisories SUSE-SU-2025:02019-1SUSE-SU-2023:1776-1SUSE-SU-2023:1622-1

  • systemd AlmaLinux 8 239-74.el8_8.2
  • systemd-pam AlmaLinux 8 239-74.el8_8.2
  • systemd-libs AlmaLinux 8 239-74.el8_8.2
  • systemd-udev AlmaLinux 8 239-74.el8_8.2
  • systemd-tests AlmaLinux 8 239-74.el8_8.2
  • systemd-container AlmaLinux 8 239-74.el8_8.2
  • systemd-journal-remote AlmaLinux 8 239-74.el8_8.2

almalinux advisories ALSA-2023:3837

  • systemd Rocky Linux 8 239-74.el8_8.2

rocky linux advisories RLSA-2023:3837

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-26604 updated cvss 6.3

systemd: privilege escalation via the less pager

  • Red Hat Enterprise Linux BaseOS (v. 8) systemd 239-74.el8_8.2, systemd-pam 239-74.el8_8.2, systemd-libs 239-74.el8_8.2, systemd-udev 239-74.el8_8.2, systemd-tests 239-74.el8_8.2, systemd-container 239-74.el8_8.2, +1 more
    fixed: vendor fix RHSA-2023:3837
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) systemd 239-58.el8_6.13, systemd-pam 239-58.el8_6.13, systemd-libs 239-58.el8_6.13, systemd-udev 239-58.el8_6.13, systemd-tests 239-58.el8_6.13, systemd-container 239-58.el8_6.13, +1 more
    fixed: vendor fix RHSA-2024:1105
  • Red Hat Enterprise Linux Server (v. 7 ELS) systemd 219-78.el7_9.11, libgudev1 219-78.el7_9.11, systemd-libs 219-78.el7_9.11, systemd-sysv 219-78.el7_9.11, systemd-python 219-78.el7_9.11 Red Hat Enterprise Linux Server Optional (v. 7 ELS) systemd-networkd 219-78.el7_9.11, systemd-resolved 219-78.el7_9.11, systemd-journal-gateway 219-78.el7_9.11
    fixed: vendor fix RHSA-2024:7705
  • Red Hat Enterprise Linux 9 systemd, systemd-pam, systemd-libs, systemd-oomd, systemd-udev, systemd-ukify, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.8

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • blog.compass-security.com https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/ referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.