{"schema_version":"1","data":[{"id":3992,"advisory_id":"b03feffe-c040-4e03-929d-b781c6c0dc38","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-24061","source_published_at":"2026-01-21T06:42:17.134+00:00","published_at":"2026-10-24T21:44:43.771532+00:00","extraction_method":"structured","technologies":["core-cve","inetutils"],"cve_ids":["CVE-2026-24061"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-24061","summary":"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.","evidence":"cve:CVE-2026-24061","products":[{"name":{"value":"Inetutils","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-24061","aliases":["CVE-2026-24061"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"GNU","product":"Inetutils","versions":[{"status":"affected","version":"1.9.3","versionType":"custom","lessThanOrEqual":"2.7"}],"defaultStatus":"unknown"}],"modified":"2026-09-29T19:43:14.235Z","provider":"cve","references":["https://www.openwall.com/lists/oss-security/2026/01/20/2","https://www.openwall.com/lists/oss-security/2026/01/20/8","https://www.gnu.org/software/inetutils/","https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html","https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b","https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc","https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package","https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package","https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-24061","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-27T04:55:30.344896Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-01-26","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061"}}}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='","tags":["exploit"]},{"url":"https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html","tags":["third-party-advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061","tags":["government-resource"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-25T13:31:53.588Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/01/22/1"},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-01-25T00:15:44.959Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-09-29T19:43:14.235Z"}}},"related_cves":[{"value":"CVE-2026-24061","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":3992,"next_before":3992}