CVE-2017-13872

Status: ModifiedHigh (8.1)—💥 Exploit

An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name.

CVSS

Version: 3.0
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base score: 8.1

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 37%
Percentile among all scored CVEs: 98
Score date: 10/9/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Metasploit module (reliable, widely available exploit) · Mac OS X Root Privilege Escalation
Published on Exploit-DB · Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation (Metasploit) (11/30/2017)
Published on Exploit-DB · Apple macOS 10.13.1 (High Sierra) - 'Blank Root' Local Privilege Escalation (11/28/2017)
Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Affected technologies (1)

Apple — MAC OS X

CWEs

CWE-287

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2017-13872",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "macOS High Sierra",
          "versions": [
            {
              "status": "affected",
              "version": "macOS High Sierra"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-29T17:29:00.217",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/101981",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1039875",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/pull/9302",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://objective-see.com/blog/blog_0x24.html",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/HT208315",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/HT208331",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43201/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43248/",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/",
      "tags": [
        "Press/Media Coverage",
        "Third Party Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/101981",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039875",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://arstechnica.com/information-technology/2017/11/macos-bug-lets-you-log-in-as-admin-with-no-password-required/",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/pull/9302",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://objective-see.com/blog/blog_0x24.html",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.apple.com/HT208315",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.apple.com/HT208331",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43201/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/43248/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/",
      "tags": [
        "Press/Media Coverage",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the \"Directory Utility\" component. It allows attackers to obtain administrator access without a password via certain interactions involving entry of the root user name."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en algunos productos Apple. Las versiones de macOS High Sierra anteriores a la actualización de seguridad 2017-001 se han visto afectadas. El problema implica el componente \"Directory Utility\". Esto permite que los atacantes obtengan acceso de administrador sin contraseña mediante ciertas interacciones relacionadas con la entrada del nombre de usuario root."
    }
  ],
  "lastModified": "2026-06-17T01:05:19.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F3DDB99-A585-427A-9236-9ACC85660116"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA2B9E19-1CC5-4168-9B1F-0068384C10D9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@apple.com"
}