Mcdope Pam Usb vulnerabilities, page 2

22 vulnerabilities

Known vulnerabilities in Mcdope Pam Usb, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.9HighCVE-2026-44711mcdope · pam_usbpam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruptionpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.EPSS0.21%8.2HighCVE-2026-44712mcdope · pam_usbpam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agentpam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some controllers allow this) can inject the payload at --add-device time. Also, userName from the XML config is passed to os.system() in pamusb-agent, which invokes a shell. This vulnerability is fixed in 0.8.7.EPSS0.21%