As far as I know it's not exploiting vulnerabilities, just the fact that it won't mind if most modules are not present.