CVE-2026-44712— pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application T1566.001 · Spearphishing AttachmentGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44712
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent
Source: NVD (National Vulnerability Database)
Vulnerability Description
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some controllers allow this) can inject the payload at --add-device time. Also, userName from the XML config is passed to os.system() in pamusb-agent, which invokes a shell. This vulnerability is fixed in 0.8.7.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
pam_usb 参数注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pam_usb是McDope个人开发者的一个基于USB设备的Linux硬件认证工具。 pam_usb 0.8.7之前版本存在参数注入漏洞，该漏洞源于配置中特制的UUID（如$(id>/tmp/rce)）在运行pamusb-conf --reset-pads时导致根权限远程代码执行，同时XML配置中的userName被传递给os.system()，可能执行shell命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44712
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 6820 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-44712
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44712 (1)
Same Patch Batch · mcdope · 2026-05-27 · 15 CVEs total
| CVE-2026-44713 | 8.8 HIGH | pam_usb: Command injection via $TMUX environment variable leads to RCE as root |
| CVE-2026-48064 | 8.1 HIGH | pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass |
| CVE-2026-44711 | 7.9 HIGH | pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and r |
| CVE-2026-44709 | 7.8 HIGH | pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution |
| CVE-2026-47269 | 7.4 HIGH | pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as |
| CVE-2026-47272 | 7.1 HIGH | pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG |
| CVE-2026-48065 | 6.7 MEDIUM | pam_usb: Unchecked integer multiplication before xmalloc() in conf.c allows heap-based buf |
| CVE-2026-47273 | 6.5 MEDIUM | pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries |
| CVE-2026-47274 | 6.3 MEDIUM | pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH ma |
| CVE-2026-47270 | 6.3 MEDIUM | pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote resul |
| CVE-2026-48066 | 5.7 MEDIUM | pam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authe |
| CVE-2026-47271 | 5.1 MEDIUM | pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process |
| CVE-2026-44710 | 4.6 MEDIUM | pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login den |
| CVE-2026-48792 | 4.4 MEDIUM | pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote deskto |
IV. Related Vulnerabilities
Same product: pam_usb
- CVE-2026-44709
pam_usb: PINENTRY_FALLBACK_APP environment variable allows a - CVE-2026-44710
pam_usb: NULL pointer dereference from UDisks device fields - CVE-2026-44711
pam_usb: Symlink attacks on pad directory and pad files enab - CVE-2026-44713
pam_usb: Command injection via $TMUX environment variable le - CVE-2026-47269
pam_usb: deny_remote feature incorrectly classifies IPv4-map
Same vendor: mcdope
- CVE-2026-44709
pam_usb: PINENTRY_FALLBACK_APP environment variable allows a - CVE-2026-44710
pam_usb: NULL pointer dereference from UDisks device fields - CVE-2026-44711
pam_usb: Symlink attacks on pad directory and pad files enab - CVE-2026-44713
pam_usb: Command injection via $TMUX environment variable le - CVE-2026-47269
pam_usb: deny_remote feature incorrectly classifies IPv4-map
Same weakness: CWE-78
- CVE-2026-11527
Config::IniFiles versions before 3.001000 for Perl allow OS - CVE-2026-11526
GD versions before 2.86 for Perl allow OS command injection - CVE-2026-46716
Nezha Monitoring: RoleMember can run shell on every server ( - CVE-2026-42853
@apostrophecms/cli: Command Injection in apos create via Uns - CVE-2026-48165
MariaDB: unsafe usage of `wsrep_sst_receive_address` values
V. Comments for CVE-2026-44712
No comments yet