ID:12442 - Exploit for Improper Neutralization of Argument Delimiters in a Command in Inetutils - GNU network utilities - CVE-2026-24061

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when processing attacker-controlled USER environment variable. A remote non-authenticated attacker can simply connect to the remote server with a specially crafted environment variable and obtain root privileges. 

Exploitation example:

USER='-f root' telnet -a <host>

Remediation