CVE-2025-49809

What it actually does

The vulnerability allows an attacker to inject and execute arbitrary commands by manipulating the MTR_PACKET environment variable when mtr is invoked in privileged contexts.

Why it matters to the business

Attackers could gain elevated privileges on affected systems, leading to full system compromise, data breaches, or disruption of services, especially in environments using sudo rules with mtr.

How an attack unfolds

An attacker configures the MTR_PACKET environment variable to point to a malicious executable and then triggers mtr execution through a privileged mechanism such as sudo, resulting in the malicious program running with elevated privileges.

How to fix it

Upgrade mtr to a fixed version such as commit 5226f105f087c29d3cfad9f28000e7536af91ac6 or apply package updates such as stakater-reloader-fips to 1.4.2-r1.

How to confirm the fix worked

Verify the installed version of mtr meets or exceeds the listed fixed versions and confirm that MTR_PACKET is ignored during privileged executions.

Typical attack path

1. Set MTR_PACKET environment variable to path of attacker-controlled executable
2. Invoke mtr in a privileged context such as via sudo rules
3. mtr executes the attacker-specified program with elevated privileges

How to detect it

Inspect process execution logs and audit records for mtr invocations that include a non-default MTR_PACKET environment variable.

• MTR_PACKET=
• mtr invoked with custom MTR_PACKET environment variable

What your security team should do

• Update mtr packages to the specified fixed versions without delay
• Audit and restrict sudo rules that permit mtr execution
• Implement environment variable sanitization for privileged binaries