If you're on the same LAN segment you can just serve a malicious boot image, no need for exploits.