CVE-2026-28372

Katalog CVE

CVSS 7.8 · High EPSS 0,20%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada gnu inetutils. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6c patch
• https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html exploit · mailing list · advisory pihak ketiga
• https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html mailing list · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2026/02/24/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/02/27/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/03/06/2
• http://www.openwall.com/lists/oss-security/2026/03/06/3
• http://www.openwall.com/lists/oss-security/2026/03/07/1
• http://www.openwall.com/lists/oss-security/2026/03/07/2