What is CVE-2017-20198?

CVE-2017-20198 is a vulnerability in D2iq, Inc. Dc/os Marathon, classified under Incorrect Permission Assignment for Critical Resource. Published 2025-07-23.

Is CVE-2017-20198 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in D2iq, Inc. Dc/os Marathon

CVE-2017-20198

The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers. Due to improper restriction of volume mount configurations, attackers can deploy a container that mounts the host's root filesystem (/) with read/write privileges. When using a malicious Docker image, the attacker can write to /etc/cron.d/ on the host, achieving arbitrary code execution with root privileges. This impacts any system where the Docker daemon honors Marathon container configurations without policy enforcement.

EPSS: 0.008 (51.6th percentile) — read the EPSS interpretation.

Affected products

D2iq, Inc. Dc/os Marathon — versions 0

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

Public proof-of-concept exploits

rapid7/metasploit-framework

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2017-20198?: CVE-2017-20198 is a vulnerability in D2iq, Inc. Dc/os Marathon, classified under Incorrect Permission Assignment for Critical Resource. Published 2025-07-23.
Is CVE-2017-20198 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.