CVE-2022-37706
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles...
- Published
- Dec 25, 2022
- Updated
- Apr 14, 2025
- Assigning CNA
- mitre
- Evidence observed
- Apr 1, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 92.9%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
Sources
modules/exploits/linux/local/ubuntu_enlightenment_mount_priv_esc.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/local/ubuntu_enlightenment_mount_priv_esc.platform)
- verification: check_declared($.exploit_linux/local/ubuntu_enlightenment_mount_priv_esc.check)
- CVE-2022-37706Exploit
Privilege escaltion exploit script for Boardlight machine on HackTheBox. I had access as the Larissa user and ran this script from the /tmp directory; script has been adjusted accordingly.
- CVE-2022-37706Exploit
All Credit to MaherAzzouzi (https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit). This is a copy of the exploit for CTFs
- CVE-2022-37706Exploit
Bash exploit script for CVE-2022-37706 enabling local privilege escalation on Ubuntu 20.04 LTS. Includes usage instructions for copying and executing the exploit on a vulnerable target.
- CVE-2022-37706Exploit
Local privilege escalation exploit for CVE-2022-37706 targeting the Enlightenment window manager's SUID binary, enabling root shell access through crafted input manipulation.
- CVE-2022-37706-LPE-exploitExploit
A reliable exploit + write-up to elevate privileges to root. (Tested on Ubuntu 22.04)
- CVE-2022-37706-SUIDExploit
CVE-2022-37706-Enlightenment v0.25.3 - Privilege escalation
- CVE-2022-37706Exploit
Local privilege escalation exploit for CVE-2022-37706 targeting Enlightenment's setuid enlightenment_sys binary on Linux, enabling unprivileged users to gain root access.
PoC
nu11secur1ty · linux · Apr 1, 2023
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.