Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-bn6y-snuj-gbdy |
|---|
| Summary | A vulnerability has been discovered in the telnetd module of inetutils, which allows remote code execution as root. |
|---|
| Aliases |
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24061 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.87007 |
| scoring_system |
epss |
| scoring_elements |
0.99431 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.87007 |
| scoring_system |
epss |
| scoring_elements |
0.99433 |
| published_at |
2026-04-07T12:55:00Z |
|
| 2 |
| value |
0.87007 |
| scoring_system |
epss |
| scoring_elements |
0.99435 |
| published_at |
2026-04-09T12:55:00Z |
|
| 3 |
| value |
0.87007 |
| scoring_system |
epss |
| scoring_elements |
0.9944 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.88021 |
| scoring_system |
epss |
| scoring_elements |
0.99486 |
| published_at |
2026-04-18T12:55:00Z |
|
| 5 |
| value |
0.88021 |
| scoring_system |
epss |
| scoring_elements |
0.99483 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.88021 |
| scoring_system |
epss |
| scoring_elements |
0.99485 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24061 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
88 |
| name |
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') |
| description |
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
|
|
|---|
| Exploits |
| 0 |
| date_added |
null |
| description |
The telnetd service from GNU InetUtils is vulnerable to authentication-bypass, tracked as CVE-2026-24061, in
versions up to version 2.7. During Telnet authentication the SB byte can be sent to indicate sub-negotiation which
allows for the exchange of sub-option parameters after both parties have agreed to enable a specific functional option.
Environment variables can be sent as sub-options and it's the USER environment variable which introduces the
authentication bypass in this scenario. When the USER environment variable gets sent to the GNU inetutils telnetd
service during authentication, the variable gets appended without proper sanitization to an execv call to the
/usr/bin/login binary. The login binary has a -f flag which skips authentication for a specific user. So the exploit
sets the `USER` environment variable to -f root and the telnetd service responds with a root shell. |
| required_action |
null |
| due_date |
null |
| notes |
Reliability:
- unreliable-session
Stability:
- crash-safe
SideEffects: []
|
| known_ransomware_campaign_use |
false |
| source_date_published |
2026-01-26 |
| exploit_type |
null |
| platform |
Linux,Unix |
| source_date_updated |
null |
| data_source |
Metasploit |
| source_url |
https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb |
|
| 1 |
| date_added |
2026-01-26 |
| description |
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable. |
| required_action |
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| due_date |
2026-02-16 |
| notes |
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cgit.git.savannah.gnu.org/cgit/inetutils.git ; https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc; https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ; https://nvd.nist.gov/vuln/detail/CVE-2026-24061 |
| known_ransomware_campaign_use |
false |
| source_date_published |
null |
| exploit_type |
null |
| platform |
null |
| source_date_updated |
null |
| data_source |
KEV |
| source_url |
null |
|
|
|---|
| Severity_range_score | 9.8 - 9.8 |
|---|
| Exploitability | 2.0 |
|---|
| Weighted_severity | 8.8 |
|---|
| Risk_score | 10.0 |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-bn6y-snuj-gbdy |
|---|