CVE-2016-7089

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/138393/ESCALATEPLOWMAN-WatchGuard-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/92638
https://www.exploit-db.com/exploits/40270/Exploit, Third Party Advisory, VDB Entry
https://www.secplicity.org/2016/08/16/nsa-equation-group-exploit-leak-mean/Third Party Advisory
http://packetstormsecurity.com/files/138393/ESCALATEPLOWMAN-WatchGuard-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/92638
https://www.exploit-db.com/exploits/40270/Exploit, Third Party Advisory, VDB Entry
https://www.secplicity.org/2016/08/16/nsa-equation-group-exploit-leak-mean/Third Party Advisory

Timeline

Published: Aug 24, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70904.0The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session CVE-2016-70914.4sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves t CVE-2016-70928.2The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors CVE-2016-70938.2Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges CVE-2016-70944.1Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial CVE-2016-70959.8Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprote CVE-2016-70974.4The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to CVE-2016-70988.1Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to b CVE-2016-70995.9The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does no CVE-2016-71016.5The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value CVE-2016-71028.4ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p CVE-2016-71036.1Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via