Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection

Sudo iptables NOPASSWD Misconfiguration Enables Local (TL-2026-2478), also tracked as sudo iptables to root privilege escalation, is a medium-severity software vulnerability, first published 2026-09-13. It has no confirmed attribution, affects Netfilter/iptables (generic sudoers misconfiguration) iptables /, maps to 10 MITRE ATT&CK techniques (T1059.004, T1078.003, T1106), and is covered by 9 detection rules and 7 indicators of compromise.

Key facts for TL-2026-2478

Threat ID
TL-2026-2478
Also known as
sudo iptables to root privilege escalation, iptables comment injection /etc/passwd overwrite, iptables --modprobe execv privilege escalation
Severity
MEDIUM
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-13
Last reviewed
2026-09-13
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
finance, retail, technology, government administration
Target regions
Global
Detection rules
9
Indicators of compromise
7

Malware and tooling in Sudo iptables NOPASSWD Misconfiguration Enables Local

Malware and tooling: CTF, suidpit

Shielder researchers (suidpit, smaury) demonstrate two local privilege-escalation techniques on Linux systems that grant a low-privileged user sudo NOPASSWD rights to iptables/iptables-save: injecting newline characters into an iptables rule comment via bash $'...' quoting and using iptables-save -f to overwrite /etc/passwd with a forged root entry, plus a secondary --modprobe/execv abuse most relevant to embedded/POS devices. No CVE is assigned because the root cause is a sudoers policy choice, not a software defect.

How Sudo iptables NOPASSWD Misconfiguration Enables Local works

On 20 September 2024, Shielder security researchers suidpit and smaury published "A Journey From sudo iptables To Local Privilege Escalation," documenting a practical root-compromise path on systems (demonstrated on Ubuntu 24.04 LTS) where a low-privileged user has been granted sudo NOPASSWD access to both /usr/bin/iptables and /usr/bin/iptables-save — a common convenience misconfiguration intended to let non-root users manage firewall rules. The attacker first confirms the grant with sudo -l and enumerates the live ruleset with iptables -L / iptables -S (the classic GTFOBins-style reconnaissance for sudo-delegated security software).

The primary technique abuses the iptables -m comment --comment option, which stores an arbitrary string associated with a rule. Using bash ANSI-C ($'...') quoting, an attacker can embed literal newline characters inside the comment value, e.g. sudo iptables -A INPUT -i lo -j ACCEPT -m comment --comment $'controlled injected lines'. Because iptables-save faithfully reproduces stored comments verbatim when dumping the ruleset, and iptables-save -f <path> writes that dump as root to an attacker-chosen path, the injected newlines let an attacker craft output that resembles arbitrary file content rather than iptables rules — a file-write primitive independently catalogued by GTFOBins under the iptables-save entry ("the data is written alongside iptables rules... works with sudo privileges since acquired privileges aren't dropped"). By generating a password hash with openssl passwd, copying the existing root /etc/passwd entry and swapping in the new hash, embedding that crafted line via the comment-injection technique, and finally running sudo iptables-save -f /etc/passwd, the attacker overwrites /etc/passwd with a modified root entry that authenticates with an attacker-known password (su root), yielding full root access.

A secondary, less broadly practical technique abuses the iptables/ip6tables --modprobe=<command> flag. Netfilter's xtables_load_ko()/xtables_insmod() logic invokes the modprobe binary specified via --modprobe (via the execv syscall) to load a kernel module required by a referenced table/target/match when that module is not already loaded. On modern desktop/server Linux the relevant modules are almost always pre-loaded, making this path impractical, but it is highly relevant to embedded devices and appliances that ship with incomplete or blacklisted module sets. This exact technique was documented years earlier in a TurinCTF 2017 Finals challenge (JBZ CTF Team writeup): with iptables listed NOPASSWD in /etc/sudoers and the nat table module deliberately blacklisted in /etc/modprobe.d/iptables.conf, contestants ran `echo -e "#!/bin/sh /bin/sh" > /tmp/shell; chmod +x /tmp/shell; sudo iptables -L -t nat --modprobe=/tmp/shell` to obtain an arbitrary root shell. It was later used in the real world: CVE-2020-28046 (CVSS 3.1 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-269) describes how, on PAX Technology ProLinOS-based Android payment terminals (D190, D200, D210, Q80, Q92, S80, S300, S800, S900, S920) running ProlinOS up to 2.4.161.8859R, a low-privileged MAINAPP user can run the setuid xtables-multi binary as `xtables-multi ip6tables -t nat -L --modprobe=/data/app/MAINAPP/bin/MablApp`; because the device lacks /proc/net/ip6_tables_names for IPv6, the modprobe path always triggers, executing the MAINAPP application binary as root. In the pax-pwn research (Giulio/lsd.cat, crediting cogitoergot00t and the JBZ crew; disclosed to PAX from June 2020), this final privesc step is chained after two earlier PAX-specific bugs: an XCB debug-service arbitrary read/write primitive (CVE-2020-28044) used to push a cross-compiled malicious shared object (built with `arm-none-eabi-gcc -shared -fPIC -o privesc.so privesc.c -nostartfiles`, embedding `setreuid(0,0); setuid(0); system("/bin/sh")`) over libsqlite3.so in a writable MAINAPP application directory, and PAX's lack of library signature verification (CVE-2020-28045) that lets that hijacked .so load and execute inside the root-executed MAINAPP process via LD_PRELOAD-style dynamic-linker hijacking — yielding uid=0(root) on the payment terminal.

Both techniques require the attacker to already hold local, low-privileged shell access and a sudoers grant covering the relevant binaries; there is no remote vector and no vendor patch is possible for the primary technique because the vulnerability is a sudoers policy decision, not a code defect. Defenders should audit sudoers/sudoers.d for NOPASSWD grants on iptables and iptables-save, avoid granting both together without strict argument restrictions, and ensure embedded/appliance Linux images pre-load all Netfilter kernel modules referenced by their iptables/ip6tables configuration so the --modprobe execution path can never trigger.

MITRE ATT&CK techniques used in TL-2026-2478

Execution

T1059.004 Unix Shell; T1106 Native API

Privilege Escalation

T1078.003 Local Accounts; T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching

Persistence

T1136.001 Local Account

Discovery

T1518.001 Security Software Discovery

Impact

T1565.001 Stored Data Manipulation

Defense Evasion

T1574.006 Dynamic Linker Hijacking

Resource Development

T1587.001 Malware

Affected products and versions in Sudo iptables NOPASSWD Misconfiguration Enables Local

  • Netfilter/iptables (generic sudoers misconfiguration) — iptables / iptables-save invoked via sudo NOPASSWD
    Vulnerable versions: Any iptables/iptables-save version where sudoers grants NOPASSWD access to both binaries without argument restrictions; demonstrated on Ubuntu 24.04 LTS
    Fixed in: No software fix — remediated only by correcting the sudoers policy (see remediation_json)
  • PAX Technology — ProLinOS-based Android/Linux payment terminals (D190, D200, D210, Q80, Q92, S80, S300, S800, S900, S920)
    Vulnerable versions: ProlinOS versions up to 2.4.161.8859R (CVE-2020-28044, CVE-2020-28045, CVE-2020-28046)
    Fixed in: PAX vendor patch addressing CVE-2020-28044/CVE-2020-28045/CVE-2020-28046

Remediation for Sudo iptables NOPASSWD Misconfiguration Enables Local

Patches

  • No upstream iptables/Netfilter code patch exists or is applicable — the primary technique exploits an administrative sudoers policy choice, not a software defect
  • PAX Technology vendor patch/mitigation for CVE-2020-28044/CVE-2020-28045/CVE-2020-28046 on affected ProLinOS payment terminal models

Immediate actions

  • Audit /etc/sudoers and /etc/sudoers.d/* for any NOPASSWD entries that grant iptables and/or iptables-save, especially unrestricted (no argument allow-list) grants
  • Remove or tighten NOPASSWD grants that allow both iptables and iptables-save together with no argument restrictions
  • Specifically restrict or forbid the -f/--file output-redirect argument to iptables-save in any sudoers Cmnd_Alias
  • Restrict the --comment argument or disallow arbitrary comment strings on iptables rules run via sudo where feasible

Workarounds

  • Never grant NOPASSWD sudo for iptables-save with an unrestricted -f/--file argument to non-root users
  • If iptables sudo delegation is required, use sudoers Cmnd_Alias entries with fixed, non-wildcard arguments so --comment and -f cannot be supplied by the delegated user
  • Require both iptables and iptables-save to be excluded from NOPASSWD together, or require a password prompt for iptables-save specifically

Longer-term hardening

  • Replace blanket binary sudoers grants with Cmnd_Alias entries pinned to fixed, non-wildcard arguments for any firewall-management delegation
  • On embedded/appliance/POS Linux images, ensure every Netfilter kernel module referenced by the deployed iptables/ip6tables ruleset is pre-loaded at boot so the --modprobe code path can never execute an attacker-supplied program
  • Deploy auditd or eBPF-based file-integrity monitoring on /etc/passwd, /etc/shadow, and other sensitive files to alert on unexpected root-owned writes from iptables-save
  • Track and patch PAX ProLinOS-based payment terminals per CVE-2020-28044/CVE-2020-28045/CVE-2020-28046 vendor guidance where these devices are in the environment
  • Periodically re-run sudo -l style sudoers audits as part of Linux host-hardening baselines

Weaknesses (CWE) in Sudo iptables NOPASSWD Misconfiguration Enables Local

CWE-269, CWE-78, CWE-93

Timeline of Sudo iptables NOPASSWD Misconfiguration Enables Local

  • TurinCTF 2017 Finals (JBZ CTF Team writeup) documents the iptables --modprobe technique: with sudo NOPASSWD on iptables and the nat kernel module deliberately blacklisted, contestants craft /tmp/shell and run sudo iptables -L -t nat --modprobe=/tmp/shell to obtain an arbitrary root shell.
  • Researcher Giulio (lsd.cat), crediting cogitoergot00t and the JBZ crew, privately discloses the pax-pwn PAX ProLinOS exploit chain (CVE-2020-28044 arbitrary read/write, CVE-2020-28045 ELF signature bypass, CVE-2020-28046 iptables --modprobe privilege escalation) to PAX Technology.
  • CVE-2020-28046 is published (CVSS 3.1 7.8 HIGH, CWE-269), documenting real-world exploitation of the setuid xtables-multi binary's ip6tables --modprobe switch to achieve root on PAX ProLinOS-based payment terminals via the pax-pwn research; PAX confirms patches in development following public disclosure.
  • No CVE is assigned and no vendor patch is issued for the primary technique, as Shielder and downstream coverage confirm the root cause is a sudoers policy choice rather than a code defect in iptables/Netfilter.
  • Shielder's official account (@ShielderSec) publicly announces the research on X, describing 'two ways to escalate sudo iptables ... into a r00t shell,' driving broader infosec community amplification (including r/netsec and independent researcher reshares).
  • The same Shielder publication documents the secondary --modprobe/execv abuse as a fallback technique, noting it is impractical on modern desktop/server Linux (modules pre-loaded) but remains applicable to embedded devices and appliances such as PAX payment terminals.
  • Shielder researchers suidpit and smaury publish 'A Journey From sudo iptables To Local Privilege Escalation,' detailing the iptables --comment newline-injection technique combined with iptables-save -f to overwrite /etc/passwd with a forged root entry, demonstrated on Ubuntu 24.04 LTS.

Sources cited for Sudo iptables NOPASSWD Misconfiguration Enables Local

More in vulnerability

Detection coverage for TL-2026-2478

As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2478 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats