Fiche vulnérabilité
CVE-2026-24061 : faille exploitée gnu inetutils (CVSS 9.8)
Description
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
En bref
- Sévérité
- Critique (CVSS 9.8)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Exploitation active
- Oui, inscrite au catalogue CISA KEV
- Publication
- 21 janv. 2026
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- gnu inetutils
- debian debian linux
Correctif et mesures
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Références
- Fiche CVE-2026-24061 sur le NVD (NIST)
- codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d…
- codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e7…
- lists.gnu.org/archive/html/bug…
- gnu.org/software/inetutils/
- openwall.com/lists/oss-security/2026/01/20/2
- openwall.com/lists/oss-security/2026/01/20/8
- vicarius.io/vsociety/posts/cve…
- vicarius.io/vsociety/posts/cve…
- openwall.com/lists/oss-security/2026/01/22/1
- lists.debian.org/debian-lts-announce/2026/01/msg00025.html
- cisa.gov/known-exploited-vulnerabilities-catalog
- labs.greynoise.io/grimoire/2026…
- openwall.com/lists/oss-security/2026/01/20/2