VulnerabilityModified

CVE-2003-1358

rs.F300 for HP-UX 10.0 through 11.22 uses the PATH environment variable to find and execute programs such as rm while operating at raised privileges, which allows local users to gain privileges by modifying the path to point to a malicious rm program.

EXPLOIT ✓HIGH 7.2EPSS 0.95%

Does this matter?

A public exploit is published in Exploit-DB (verified) and the impact is high, while EPSS rates exploitation at 1.0%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use.

Description

CVSS 2.0: 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS: 0.95% probability · 61th percentile
Public exploits: 1 in Exploit-DB · verified · first 12 February 2003
CISA KEV: Not listed
Weakness: CWE-264
Affected: hp/hp-ux
Source: cve@mitre.org

EPSS trend

EPSS 1.0% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-22248 source ↗	HP-UX 10.x - rs.F3000 Unauthorized Accesshp-ux · Last Stage of Delirium	local	12 February 2003	yes

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.