CVE-2023-40303
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
GNU inetutils before 2.5 may allow privilege escalation due to unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd.
Risk Assessment
The organization may be exposed to privilege escalation, allowing ordinary users to take control of processes that should be restricted.
Recommendation
It is recommended to update GNU inetutils to version 2.5 or later to mitigate this vulnerability.
Other vulnerabilities in GNU inetutils
See all- CVE-2026-32746Medium
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
- CVE-2026-32772Medium
A vulnerability in telnet in GNU inetutils through version 2.7 allows servers to read arbitrary environment variables from clients via the NEW_ENVIRON SEND USERVAR command.
Original NVD description (English source)
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.