CVE-2026-24061

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,0%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada gnu inetutils, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut mitre.org. Masuk katalog KEV CISA pada 26 Januari 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

99,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

GNU InetUtils Argument Injection Vulnerability

Masuk KEV

26 Januari 2026

Tenggat CISA

16 Februari 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html mitigasi · advisory vendor
• https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc patch
• https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b patch
• https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-in... mitigasi · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061 pemerintah AS
• https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass exploit · advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-ine... advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html mailing list · advisory pihak ketiga
• https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/in... exploit · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER=' mailing list · advisory pihak ketiga
• https://www.gnu.org/software/inetutils/ product
• https://www.openwall.com/lists/oss-security/2026/01/20/2 mailing list
• https://www.openwall.com/lists/oss-security/2026/01/20/8 mailing list
• http://www.openwall.com/lists/oss-security/2026/01/22/1 mailing list