PT-2026-22300 · Gnu · Gnu Inetutils

Ron Ben Yizhak · Published 2026-02-27 · Updated 2026-03-07 · CVE-2026-28372

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU inetutils versions through 2.7

Description A privilege escalation issue exists in telnetd within GNU inetutils. The issue stems from improper handling of the CREDENTIALS DIRECTORY environment variable, introduced with systemd service credentials support in the login(1) implementation of util-linux release 2.40. An unprivileged local user can exploit this by creating a login.noauth file.

Recommendations Update to a version of GNU inetutils later than 2.7.

Exploit

Fix

LPE

Weakness Enumeration

CWE-829

Related Identifiers

BDU:2026-02403

CVE-2026-28372

Affected Products

Gnu Inetutils

References · 27

• 🔥 https://github.com/mbanyamer/CVE-2026-28372-GNU-inetutils-telnetd-Privilege-Escalation · Exploit
• 🔥 https://github.com/kalibb/CVE-2026-28372-GNU-inetutils-telnetd-Privilege-Escalation-main · Exploit
• 🔥 https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html · Exploit
• https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6c · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28372 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0512SE18MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28372 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28372 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28372 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28372 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28372 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02403 · Security Note
• https://ubuntu.com/security/CVE-2026-28372 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28372#:~:text=telnetd%20in%20GNU%20inetutils%20through,git/commit/?id=4db2f19f4caac03c7f4da6363c140bd70df31386 · Vendor Advisory
• https://twitter.com/cracbot/status/2029149998781481166 · Twitter Post