PT-2025-18214 · Finit+1 · Finit+1

Troglobit · Published 2025-03-18 · Updated 2025-06-23 · CVE-2025-29906

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Finit versions 3.0-rc1 through 4.11

Description Finit is a fast init for Linux systems. The issue concerns the implementation of getty for the tty configuration directive, which can bypass /bin/login, allowing a user to log in as any user without authentication. This can be exploited by manipulating the login prompt and requires access to the console. The problem has been patched in version 4.11.

Recommendations To resolve the issue, update to version 4.11 or later, as this version includes the patch for the authentication bypass issue. As a temporary workaround, consider restricting access to the console to minimize the risk of exploitation.

Exploit

Fix

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-05115

CVE-2025-29906

GHSA-563G-P98J-MC9Q

Affected Products

Debian

Finit

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29906.json · Exploit
• https://ubuntu.com/security/CVE-2025-29906 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-29906 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-29906 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-29906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29906 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-29906 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29906 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05115 · Security Note
• https://github.com/troglobit/finit/security/advisories/GHSA-563g-p98j-mc9q · Note
• https://github.com/troglobit/finit/commit/6528628b5c771c25ffa0cb1a46c6c89d9d0d69e0 · Note
• https://github.com/troglobit/finit · Note
• https://t.me/latest_high_impact_cve/2224 · Telegram Post
• https://t.me/tmfeed/244330 · Telegram Post
• https://twitter.com/cybercronai/status/1917625710727807432 · Twitter Post