CVE-2017-18348

CVE-2017-18348 describes a privilege escalation vulnerability in Splunk Enterprise 6.6.x when configured to run as root but drop privileges to a non-root account. A local attacker with access to this non-root account can modify configuration files and insert malicious programs into Splunk’s binary directory, leading to full system compromise. This vulnerability has a CVSSv3 score of 7.0 (High), indicating a high impact on confidentiality, integrity, and availability, with high attack complexity. There is currently no public exploit code available, it is not listed in CISA's KEV catalog, and there is no evidence of active exploitation or significant community discussion.