Every program with one of the set-user/group-upon-execution bits 1 set is a potential security risk. In the example given in this question 2, the change-pass script permissions permit the running of the script and the passwd program with root privileges using the environment name space copied from other users.
The program passwd is running in terminal mode, as opposed to standard input mode, and does not want the terminal to echo password characters to the display. It calls ttyname to get the name of the terminal from the environment variable TERM to shut the echo off and otherwise direct i/o.
By substituting a back-quoted set of shell commands for the value of TERM it is possible to create an unrestricted shell to non-root users. The single quoting in the env command ensures the evaluation is postponed, in at least some shell implementations 3, until the getenv call is made for TERM by ttyname.
The unsuspecting member of the group helpdesk could open a back door to the attacker, simply by resetting a customer password using change-pass.
 The ls -l command shows this as an 's' in the permission codes. It is the '4' in the example's chmod command codes. The user and group versions of these bits are abbreviated SUID and SGID.
 This same exploit is reported to be effective with environment variable MAIL_CONFIG and the executable that acquires it from the environment, sudo, in the same fashion. (Credit to @adam-shostack for this alternate example.)
 There may be implementations that postpone TERM evaluation until the environment copy is made for the child process, the change-pass script. It is more likely that POSIX or some other standard governs when evaluation occurs and that it always defers until the value is requested.