9.8

CVE-2026-24061

Warnung
Medienbericht
Exploit
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Inetutils Version >= 1.9.3 <= 2.7
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login

26.01.2026: CISA Known Exploited Vulnerabilities (KEV) Catalog

GNU InetUtils Argument Injection Vulnerability

Schwachstelle

GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 91.12% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cve@mitre.org 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.