CVE-2025-29906: Troglobit Finit

High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days.

Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration directive that can bypass `/bin/login`, i.e., a user can log in as any user without authentication. This issue has been patched in version 4.11.

Affected products

• Troglobit Finit: from 3.0-rc1, before 4.11 (fixed in 4.11)

Published 2025-04-29. Last modified 2026-06-17.