CVE-2017-5671

CVE-2017-5671 is a local privilege escalation vulnerability affecting several Honeywell Intermec industrial printers, including the PM23, PM42, PM43, PC23, PC43, PD43, and PC42 models running specific firmware versions. The vulnerability stems from the /usr/bin/lua binary being installed setuid to the itadmin account, allowing a local attacker to perform a BusyBox jailbreak. This enables the attacker to overwrite the /etc/shadow file, thereby gaining root privileges on the device. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. An attacker with local access can easily achieve full control over the affected printer. Despite its severity, the vulnerability is not listed on CISA's KEV catalog, suggesting it's not widely exploited in the wild. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an exploit (EDB-41754) is publicly available on ExploitDB. Community discussion and media coverage are minimal, indicating a lack of widespread public attention.