Description

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-11T09:17:14.493Z",
  "pubdate": "2026-08-11T09:17:14.493Z",
  "executiveSummary": "A symbolic link following vulnerability has been identified in MRTG when the daemon is initiated with root privileges prior to privilege dropping. This security flaw enables a local, low-privileged threat actor to manipulate or pre-place a symbolic link within the process ID (PID) file path structure.\nUpon initialization and subsequent privilege reduction, the privileged root process interacts with the attacker-controlled symbolic link, inadvertently modifying the ownership of an arbitrary system file to match the unprivileged daemon user account. This improper handling of file system objects during daemon startup creates a viable vector for local privilege escalation.\nThe affected product is MRTG running in daemon mode under root user privileges. Successful exploitation requires local system access, pre-existing low-privileged execution capabilities, and the ability to manipulate file paths where the PID file is instantiated. The resulting impact compromises system integrity and confidentiality, as unauthorized access or modification of critical sensitive files becomes attainable for the attacker.",
  "technicalDetails": "The vulnerability stems from insecure file handling practices during the startup and privilege-dropping phase of the MRTG daemon. When the application is launched with root privileges, it attempts to create, open, or manage a process ID (PID) file at a predictable file system path before shedding elevated privileges and switching to a low-privileged daemon user context.\nThe root cause is a classic Time-of-Check to Time-of-Use (TOCTOU) race condition compounded by unsafe symbolic link resolution. The application fails to adequately verify whether the target PID file location is a pre-existing symbolic link pointing to a critical system file, nor does it enforce strict creation flags (such as O_NOFOLLOW or exclusive creation checks) that prevent following arbitrary symlinks.\nThe attack flow proceeds as follows: First, a local attacker with low privileges identifies the target path where the MRTG daemon is configured or expected to write its PID file. Second, the attacker establishes a symbolic link at that specific path pointing to a sensitive system file whose ownership they wish to compromise (e.g., critical configuration files, binaries, or data stores). Third, the MRTG daemon is initiated or restarted as the root user. Fourth, during its startup routine, the root process attempts to write or alter permissions on the PID file, blindly following the attacker-controlled symbolic link. Fifth, the application inadvertently alters the ownership of the pointed-to arbitrary file, transferring ownership to the low-privileged daemon user.\nAuthentication requirements are nonexistent locally, as the attacker leverages standard local file system interactions. Privilege requirements involve a low-privileged local user capable of creating symbolic links in the relevant directory. Network exposure is local-only, requiring local shell access or an auxiliary vector to place the symlink. Payload behavior does not involve remote code execution payloads directly, but rather weaponizes the administrative file ownership alteration primitive. Post-exploitation impact includes local privilege escalation, unauthorized data access, and unauthorized modification of sensitive files, potentially allowing the attacker to escalate privileges fully by tampering with files writable by the newly acquired daemon user."
}