From restricted CLI to root

This talk presents a vulnerability in a telephony appliance that allows escaping a restricted CLI to achieve arbitrary code execution. I will walk through the discovery process and the exploitation technique. While the overall risk is relatively low—since it requires access to the CLI—the techniques involved are quite similar to those found in CTF challenges.