CVE-2016-7089

published 2016-08-24

CVE-2016-7089: WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN.

Priority P2 77 high 7.8 CVSS 3.0

AV L AC L PR L UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN.

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40270.zip↗

• → Monitor for crafted/anomalous ifconfig command execution on WatchGuard RapidStream appliances, particularly when invoked by non-root local users, as this is the exploitation vector for ESCALATEPLOWMAN privilege escalation. ↗
• → The exploit is attributed to the Shadow Brokers group; presence of the exploit binary (40270.zip) or its contents on a WatchGuard appliance filesystem should be treated as a strong indicator of compromise. ↗

• · This vulnerability is specific to WatchGuard RapidStream appliances; exploitation requires local user access, limiting the attack surface to authenticated local sessions. ↗

CVSS provenance

nvd v3.0 7.8 HIGH CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

vulncheck 7.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264