Description
Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can bypass `/bin/login`, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.11.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/troglobit/finit/security/advisories/GHSA-563g-p98j-mc9q
Scores
CVSS v3
8.6
EPSS
0.0006
EPSS Percentile
18.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-287
Status
published
Products (1)
troglobit/finit
>= 3.0-rc1, < 4.11
Published
Apr 29, 2025
Tracked Since
Feb 18, 2026