HIGHCVE-2026-28372Published Modified CNA mitre
CVE-2026-28372: telnetd in GNU inetutils through 2
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.
Metrics
- CVSS v3.1
- 7.4
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
Affected packages
- GNU / inetutils≤ 2.7
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H