CVE-2002-2040

CVE-2002-2040 describes a local privilege escalation vulnerability affecting QNX RTOS versions 4.25 and 6.1.0. The phrafx and phgrafx-startup programs fail to properly drop privileges, allowing a local attacker to execute arbitrary commands by manipulating the PATH environment variable to point to a malicious crttrap program. With a CVSS score of 7.2, this vulnerability has high impact on confidentiality, integrity, and availability, requiring low attack complexity and no authentication. While not listed on the KEV catalog or showing active exploitation, public exploit code exists on ExploitDB, though it has garnered minimal community discussion or media coverage.