CVE-2026-24061

Опубликовано: 21 янв. 2026

Источник: nvd

CVSS3: 9.8

EPSS Критический

Описание

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Ссылки

https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
Patch
https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
Patch
https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
Mitigation
Vendor Advisory
https://www.gnu.org/software/inetutils/
Product
https://www.openwall.com/lists/oss-security/2026/01/20/2
Mailing List
https://www.openwall.com/lists/oss-security/2026/01/20/8
Mailing List
https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package
Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package
Mitigation
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/22/1
Mailing List
https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html
Mailing List
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061
US Government Resource
https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html
Exploit
Third Party Advisory
https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*

Версия от 1.9.3 (включая) до 2.7 (включая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.97878

Критический

9.8 Critical

CVSS3

Дефекты

CWE-88

Связанные уязвимости

CVE-2026-24061

CVSS3: 9.8

ubuntu

7 месяцев назад

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

CVE-2026-24061

CVSS3: 9.8

debian

7 месяцев назад

telnetd in GNU Inetutils through 2.7 allows remote authentication bypa ...

GHSA-pf97-p8ff-fj35

CVSS3: 9.8

github

7 месяцев назад

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

BDU:2026-00709

CVSS3: 9.8

fstec

7 месяцев назад

Уязвимость сервера telnetd пакета сетевых программ Inetutils, позволяющая нарушителю обойти существующие механизмы безопасности

EPSS

Процентиль: 100%

0.97878

Критический

9.8 Critical

CVSS3

Дефекты

CWE-88