Inetutils
CVE-2026-28372
HIGH
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
AnalysisAI
Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).
Technical ContextAI
This vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) affects Inetutils. telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
RemediationAI
A vendor patch is available — apply it immediately.
GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v
OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today