Also known as: RCE · arbitrary code execution · remote code exec
Remote code execution (RCE) is a class of vulnerability that allows an attacker to run arbitrary code on a target system over a network, without physical access to that machine.
RCE is generally considered the most severe vulnerability class because it collapses the distance between an attacker and full system control. Whether it grants a foothold or immediate total compromise depends on what privileges the vulnerable process holds and how well the system is segmented.
The critical qualifier on any RCE is whether it is pre-authentication or post-authentication. A pre-auth RCE requires only network reachability and is exploitable by anyone who can connect. A post-auth RCE requires valid credentials first, which dramatically narrows who can use it.
A heap buffer overflow in an SSH server's key-exchange handshake that executes attacker-supplied code before login completes is a pre-authentication RCE — the most dangerous variant.
Privilege Escalation
Privilege escalation is the act of exploiting a flaw or misconfiguration to gain a higher level of access than originally granted, such as moving from an unprivileged user account to administrator or root.
Exploit
An exploit is code or a technique that takes advantage of a specific vulnerability to cause unintended behaviour, such as executing attacker-supplied code, bypassing authentication, or crashing a service.
Buffer Overflow
A buffer overflow is a memory-safety vulnerability in which a program writes more data into a fixed-size memory buffer than it can hold, corrupting adjacent memory and potentially allowing an attacker to alter program execution.
Zero-Day
A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.
Lateral Movement
Lateral movement is the process by which an attacker who has compromised one system moves through a network to reach additional systems, typically hunting for higher-value data or credentials.