{"cve":"CVE-2017-6590","nvd":{"published":"2017-03-09T19:59:00.317","modified":"2026-06-17T01:22:36.323","status":"Modified","description":"An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation requires physical access to the locked computer and the Wi-Fi must be turned on. An access point that lets you use a certificate to login is required as well, but it's easy to create one. Then, it's possible to open a nautilus window and browse directories. One also can open some applications such as Firefox, which is useful for downloading malicious binaries.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":6.3},"cwes":["CWE-863"],"references":["http://www.securitytracker.com/id/1037977","https://bugs.launchpad.net/ubuntu/+source/network-manager-applet/+bug/1668321","https://security.gentoo.org/glsa/201707-09","https://www.ubuntu.com/usn/usn-3217-1/","https://www.youtube.com/watch?v=Fp2lwRVg0l0"],"products":["canonical:ubuntu_linux"],"source":"nvd","synced_at":"2026-10-19T20:41:54.846948762+00:00"},"epss":{"cve":"CVE-2017-6590","score":0.00279,"percentile":0.2045,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}