9.8

CVE-2026-24061

Warnung
Medienbericht
Exploit
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Inetutils Version >= 1.9.3 <= 2.7
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login

26.01.2026: CISA Known Exploited Vulnerabilities (KEV) Catalog

GNU InetUtils Argument Injection Vulnerability

Schwachstelle

GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 98.87% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve@mitre.org 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
18.03.2026 07:05
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
27.01.2026 12:35
https://www.openwall.com/lists/oss-security/2026/01/20/2
Mailing List
https://www.openwall.com/lists/oss-security/2026/01/20/8
Mailing List
https://www.gnu.org/software/inetutils/
Product
http://www.openwall.com/lists/oss-security/2026/01/22/1
Mailing List
https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html
Third Party Advisory
Mailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061
US Government Resource
https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html
Third Party Advisory
Exploit
https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
Patch
https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
Patch
https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
Vendor Advisory
Mitigation
https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package
Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package
Third Party Advisory
Mitigation