CVE-2026-24061 | telnetd | AB

Vulnerability	CVE-2026-24061
Type	Unauthenticated Remote Authentication Bypass → Remote Code Execution (Root) / Argument Injection (CWE-88: Improper Neutralization of Argument Delimiters in a Command)
Description	A critical vulnerability in the GNU InetUtils `telnetd` daemon allows an unauthenticated remote attacker to bypass authentication entirely and obtain an interactive root shell. `telnetd` delegates authentication to `/usr/bin/login`, building the login command line from a template containing a `%U` placeholder that is substituted with the client-controlled `USER` environment variable. Because this value is never sanitized before being passed as a command-line argument, an attacker who sets `USER` to `-f root` (via the Telnet NEW-ENVIRON option) injects the `login -f` “force login” flag, which skips password verification and drops the attacker directly into a root session. The flaw was introduced by a 2015 commit (in InetUtils 1.9.3) and remained exploitable for roughly 11 years.
Affected Systems	- GNU InetUtils `telnetd` in all versions from 1.9.3 through 2.7 (the vulnerable code was added in commit `fa3245ac` and persists up to the patched distribution package revision, e.g., Debian `inetutils 2.7-2`). - Affects any Linux/UNIX system, embedded device, network appliance, or OT-adjacent host that ships and enables GNU InetUtils `telnetd`. - Known affected distributions include Debian, Ubuntu, Kali Linux, Trisquel, and SUSE. - Not affected: Red Hat Product Security has confirmed that all currently supported Red Hat products are unaffected. Telnet clients and hosts where `telnetd` is not installed/enabled are not exposed.
Attack Vector	- Protocol: Telnet over TCP (default port 23; active services have also been seen on non-standard ports) - Authentication: Not required (pre-authentication) - User Interaction: Not required - Attack Complexity: Low (single-step, no special conditions) - Privileges Gained: Root (full administrative control of the host) - Target: Any GNU InetUtils `telnetd` listener that is accessible via the internet or network - Payload Delivery: In the initial protocol handshake, craft a Telnet NEW-ENVIRON (RFC 1572) sub-negotiation that sets `USER=-f root`
Exploit Mechanism	The exploit takes advantage of the way `telnetd` constructs the `login` invocation when a session begins: 1. `telnetd` builds a command-line string (`login_invocation`) using a template with a `%U` placeholder for the user’s name. 2. The `%U` placeholder is expanded (`expand_line` → `_var_short_name`) to the value of the `USER` environment variable. 3. The Telnet protocol NEW-ENVIRON option can be used by the client set the `USER` variable during negotiation (autologin / pre-filling the username). 4. `telnetd` does not sanitize this client-supplied value before inserting it into the `/usr/bin/login` argument list. 5. An attacker sets `USER` to `-f root` and the server effectively executes `login -f root`. 6. The `-f` flag of the `login` binary skips interactive authentication (“force login”) and treats the user as already authenticated. 7. The attacker is presented with a root shell, with no credentials. 8. Researchers showed that arbitrary environment variables (e.g. `PATH`) can be injected and inherited by `telnetd` child processes, increasing the impact.
The Impact of the Bug	Successful exploitation yields pre-authentication, single-step remote root access on the target. With full control, an attacker can stay hidden, steal login information, access cloud data, move into other networks, change files, create new software, install malware or miners, or interrupt services.The risk is higher when embedded devices and appliances are deployed in fleets and are challenging to patch or rebuild. Multiple public PoCs and automated scanners exist, and active exploitation has been reported in the wild, with vendors observing distinct attack waves beginning around 22 January 2026 that progressed from probing to weaponization. CVSS severity: Critical (9.8).
How to detect if you have a vulnerable application to this attack vector?	- Determine if `telnetd` is installed/enabled and determine the version (e.g. `telnetd --version`); determine if GNU InetUtils versions 1.9.3 through 2.7 / pre-patch package revisions are used. - Inventory hosts listening on TCP/23 (and non-standard Telnet ports) using internal scanning, Shodan/Censys, or cloud asset discovery. - Network level: monitor Telnet sessions for NEW-ENVIRON option negotiation carrying a `USER` value that begins with `-f` (e.g. payload pattern `...USER...-f root...`). - Host level: review `/var/log/auth.log` or `/var/log/secure` for `telnetd` root logins with no corresponding password prompt and for entries matching `USER.-f`. - Audit unexpected root shell processes spawned by the `telnetd` daemon*. - Look for anomalous child-process behavior consistent with injected `PATH`/environment variables.
Mitigation Steps	Immediate Patching (Priority 1): - Apply the upstream GNU InetUtils fix (commits `fd702c02` and `ccba9f74`, released 20 January 2026) or upgrade to a distribution package that incorporates it (e.g., Debian `inetutils 2.7-2` or later). The patch rejects `USER` values that begin with a dash (`-`). - Track and apply your distribution’s security update (note: some distros, e.g., Ubuntu, had patches pending at initial disclosure). Network Controls / WAF-NIDS: - Block inbound TCP/23 at the perimeter (`iptables -A INPUT -p tcp --dport 23 -j DROP` / equivalent nftables rule). - Deploy IDS/IPS signatures for NEW-ENVIRON `USER=-f root` injection attempts. - Restrict any required Telnet access to trusted source IPs only. If Immediate Patching Not Possible: - Disable `telnetd` entirely — the upstream maintainer recommends not running `telnetd` at all. - Replace Telnet with a modern, encrypted protocol such as SSH. - Where supported, configure `login` to reject `-f` from untrusted callers / enforce `--` argument termination. - Enforce strict network segmentation around management and OT environments. Post-Remediation: - Review logs for pre-patch exploitation attempts (unauthenticated root logins via `telnetd`). - If compromise is suspected, rotate all secrets, keys, and credentials. - Check for persistence (cron, systemd units, modified binaries/build artifacts) and validate host integrity.
References	- https://nvd.nist.gov/vuln/detail/CVE-2026-24061 - https://www.cve.org/CVERecord?id=CVE-2026-24061 - https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/ - https://github.com/SafeBreach-Labs/CVE-2026-24061 - https://www.openwall.com/lists/oss-security/2026/01/20/2 - https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html - https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c288b87139a0da8249d0a408c4dfb87 (introducing commit) - https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b (fix) - https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc (fix) - https://security-tracker.debian.org/tracker/CVE-2026-24061 - https://www.cyber.gc.ca/en/alerts-advisories/al26-002-vulnerability-affecting-gnu-inetutils-telnetd-cve-2026-24061 - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-24061/ - https://orca.security/resources/blog/cve-2026-24061-gnu-inetutils-telnetd-bypass/ - https://www.txone.com/blog/cve-2026-24061-gnu-inetutils-telnet-exploitation/ - https://www.offsec.com/blog/cve-2026-24061/

Appendix: Detection & Threat-Intel Artifacts
#

The following network and SIEM detection content is adapted from the public PoC repository (franckferman/CVE_2026_24061) and other vendor write-ups. The exploit’s network footprint is highly specific because the malicious value -f root must travel inside a Telnet NEW-ENVIRON (0x27) sub-negotiation, which makes a reliable content match feasible.

Snort / Suricata
#

# Exploit attempt: USER environment variable set to "-f root" inside NEW-ENVIRON IS
alert tcp any any -> any 23 ( \
  msg:"CVE-2026-24061 telnetd USER=-f root exploit attempt"; \
  content:"|FF FA 27 00 00|USER|01|-f root|FF F0|"; \
  sid:2026240610; rev:1; )

# Broader / generic: any NEW-ENVIRON USER value beginning with a dash (option-like)
alert tcp any any -> any 23 ( \
  msg:"CVE-2026-24061 telnetd NEW-ENVIRON USER value starts with dash (arg injection)"; \
  content:"|FF FA 27 00 00|USER|01|-"; \
  sid:2026240611; rev:1; )

Note: byte breakdown of the payload — FF FA (IAC SB), 27 (NEW-ENVIRON), 00 (IS), 00 (VAR), USER, 01 (VALUE), -f root, FF F0 (IAC SE). Tune the port if Telnet is exposed on non-standard ports (active campaigns have used both standard and non-standard ports).

Host-Based Detection (Sigma concept / log review)
#

Review /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL-family) for telnetd-originated root logins with no preceding Password: prompt, and for entries matching the pattern USER.*-f.
Alert on root shell processes whose parent process is telnetd (or in.telnetd).
Flag login invocations whose argument vector contains -f originating from the Telnet service.

MITRE ATT&CK Mapping
#

ATT&CK ID	Tactic	Technique
T1190	Initial Access	Exploit Public-Facing Application
T1059	Execution	Command and Scripting Interpreter
T1078.004	Privilege Escalation / Defense Evasion	Valid Accounts: Local Accounts
T1548	Privilege Escalation	Abuse Elevation Control Mechanism (`login -f`)
T1046	Discovery	Network Service Discovery (mass scanning component)

Threat-Intel Imports
#

MISP: import the repo’s indicators/misp_event.json (Events > Add Event > Import from > JSON). It bundles the CVE ID, CVSS vector, Snort signature, payload hex, ATT&CK tags, CPE, and references.
STIX 2.1: import indicators/stix_bundle.json into OpenCTI / TAXII / any STIX 2.1 consumer (11 objects: Vulnerability, network-pattern Indicator, Attack Patterns, Course of Action, Identity, and relationships).

CVSS v3.1 Vector
#

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H → Base 9.8 (Critical).

Operational caveat: these signatures detect the exploit in transit over cleartext Telnet. They will not catch exploitation over a tunneled/encrypted channel, and they are a detection aid — not a substitute for patching or disabling telnetd.

Appendix: Detection & Threat-Intel Artifacts#

Snort / Suricata#

Host-Based Detection (Sigma concept / log review)#

MITRE ATT&CK Mapping#

Threat-Intel Imports#

CVSS v3.1 Vector#