CVE-2026-48980

{
  "id": "CVE-2026-48980",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-18T20:16:14.273",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2,  getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2."
    },
    {
      "lang": "es",
      "value": "pam_usb proporciona autenticación de hardware para Linux utilizando medios extraíbles. En versiones anteriores a la 0.9.2, las variables de entorno getenv() XRDP_SESSION, DISPLAY y TMUX permiten la inyección de variables de entorno en la lógica de verificación local. Estas variables de entorno influyen en si una sesión actual es local o remota, y un módulo PAM que se ejecuta en el contexto de binarios setuid (sudo, su), getenv() devuelve valores controlados por el atacante siempre que el entorno del proceso haya sido manipulado por un usuario local. Este problema ha sido solucionado en la versión 0.9.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "mcdope",
          "product": "pam_usb",
          "versions": [
            {
              "version": "< 0.9.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T20:25:21.713697Z",
          "id": "CVE-2026-48980",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-454"
        },
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mcdope/pam_usb/releases/tag/0.9.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/mcdope/pam_usb/security/advisories/GHSA-qr83-mf3h-fvqr",
      "source": "[email protected]"
    }
  ]
}