CVE-2017-5671

Published: Mar 29, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.0 / Impact: 6.0

Source: NVD

Description

Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file.

Affected (7)

Products: Honeywell: Intermec Pc23 Firmware, Intermec Pc42 Firmware, Intermec Pc43 Firmware, Intermec Pd43 Firmware, Intermec Pm23 Firmware, Intermec Pm42 Firmware, Intermec Pm43 Firmware

Honeywell

7 products

Intermec Pc23 Firmware

Intermec Pc42 Firmware

Intermec Pc43 Firmware

Intermec Pd43 Firmware

Intermec Pm23 Firmware

Intermec Pm42 Firmware

Intermec Pm43 Firmware

Configuration A

7 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Honeywell Intermec Pc23 Firmware	Up to 10.10.011406
Honeywell Intermec Pc42 Firmware	Up to 10.10.011406
Honeywell Intermec Pc43 Firmware	Up to 10.10.011406
Honeywell Intermec Pd43 Firmware	Up to 10.10.011406
Honeywell Intermec Pm23 Firmware	Up to 10.10.011406
Honeywell Intermec Pm42 Firmware	Up to 10.10.011406
Honeywell Intermec Pm43 Firmware	Up to 10.10.011406

Running on/with	Platform Versions
Honeywell Intermec Pc23	All versions
Honeywell Intermec Pc42	All versions
Honeywell Intermec Pc43	All versions
Honeywell Intermec Pd43	All versions
Honeywell Intermec Pm23	All versions
Honeywell Intermec Pm42	All versions
Honeywell Intermec Pm43	All versions