CVE-2002-0424

CVE-2002-0424 describes a local privilege escalation vulnerability in efingerd versions 1.61 and earlier. When efingerd is configured without the -u option, it executes .efingerd files as the efingerd user (typically "nobody"), allowing local users to gain privileges by modifying their own .efingerd file and running finger. This vulnerability has a CVSS score of 4.6, indicating a low severity with local access, low attack complexity, and partial impact on confidentiality, integrity, and availability. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV entry, though it has received some community discussion with 10 mentions.