CVE-2017-13872

CVE-2017-13872 is a critical privilege escalation vulnerability affecting macOS High Sierra before Security Update 2017-001, specifically within the "Directory Utility" component. This flaw allows an attacker to gain administrator (root) access without a password through specific interactions involving the root username. With a CVSS score of 8.1 (HIGH) and an EPSS score indicating high exploitability, the impact is severe, leading to complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV, public exploit code is readily available via Metasploit and ExploitDB, and it garnered significant community discussion and media coverage at the time of its discovery.