The pam_usb authentication module passes the removable device’s UUID and the XML configuration’s username directly to operating system utilities without sanitization. An attacker can craft a UUID containing shell metacharacters (e.g., $(id>/tmp/rce)) or alter the username field, which is then executed by pamusb-conf during pad reset or by pamusb-agent during a login attempt. This flaw enables arbitrary shell execution with root privileges, representing a severe command injection vulnerability (CWE-78, CWE-88).

The affected product is pam_usb by mcdope. Any installation of pam_usb prior to version 0.8.7 is vulnerable; versions 0.8.7 and later contain the fix.

The CVSS score of 8.2 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must physically control a USB device with a malcrafted filesystem UUID or modify the XML configuration to inject the payload. Based on the description, it is inferred that the attack vector is local; it requires physical access to a vulnerable machine or the ability to supply a malicious USB device. Once executed, the attacker gains root-level access, compromising confidentiality, integrity, and availability of the entire system.