A flaw in the MRTG daemon allows an attacker who has local low privileges to manipulate the symbolic link used in the PID file path. When the daemon is started as root and later drops privileges, the root process can follow the symlink and change the ownership of any existing file to the unprivileged daemon user. This enables the attacker to gain unauthorized write access to sensitive files and is classified as a local privilege escalation weakness (CWE‑59).

The vulnerability affects Red Hat Enterprise Linux releases 10, 6, 7, 8, and 9 that include the MRTG daemon. Specific version information is not supplied, so any installation containing this daemon is potentially affected.

The CVSS score of 7.1 reflects a moderate to high severity, while the EPSS score is not reported, indicating limited publicly known exploitation data. The flaw is not listed in the CISA KEV catalog. Attack requires local access to the host and the ability to start MRTG as root with the `--daemon` flag; an attacker must also create or influence a symlink in the specified PID file location. Once those conditions are met, the daemon will change file ownership, achieving local privilege escalation.