CVE-2017-14610

CVE-2017-14610 describes a privilege escalation vulnerability in Bareos 16.2.6 and earlier, specifically affecting bareos-dir, bareos-fd, and bareos-sd components. The flaw allows a local attacker with access to the non-root Bareos account to modify the PID file after the process drops privileges. This manipulation could lead to the termination of arbitrary processes when a root script subsequently executes a "kill" command based on the tampered PID file. Rated with a CVSS score of 7.8 (High), this vulnerability has a local attack vector and low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. While the EPSS score is very low, indicating a minimal likelihood of exploitation in the wild, the FAUCET Risk Score of 56/100 suggests a moderate overall risk. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, which is typical for a large percentage of CVEs.