---
id: CVE-2023-26604
title: >-
  systemd before 247 does not adequately block local privilege escalation for
  some Sudo configurations, e.g., plausible sudoers files in which the
  "systemctl status" command may be executed
summary: >-
  systemd before 247 does not adequately block local privilege escalation for
  some Sudo configurations, e.g., plausible sudoers files in which the
  "systemctl status" command may be executed. Specifically, systemd does not set
  LESSSECURE to…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
vendor: systemd_project
product: systemd
affected:
  - debian_linux = 10.0
  - systemd < 246.7
patched:
  - systemd 246.7
published: '2023-03-03'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T23:17:15.447'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-26604'
references:
  - url: >-
      http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html
    label: cve@mitre.org
  - url: >-
      https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/
    label: cve@mitre.org
  - url: 'https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html'
    label: cve@mitre.org
  - url: >-
      https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20230505-0009/'
    label: cve@mitre.org
  - url: >-
      http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230505-0009/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.01051
epssPercentile: 0.63574
ingestedAt: '2026-10-15T00:02:07.129Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-03-07T18:16:19.952528Z'
---

## Overview

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

## Affected

- `debian_linux = 10.0`
- `systemd < 246.7`

## Remediation

Upgrade past the affected range:

- `systemd 246.7`