CVE-2026-24061

Published Jan 21, 2026

Last updated 3 months ago

Exploit known CVSS critical 9.8

telnetd

Network

IoT

Tunneling protocol

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-24061 is an authentication bypass vulnerability affecting the Telnet service provided by GNU Inetutils through version 2.7. This flaw allows an unauthenticated remote attacker to bypass standard authentication checks and gain access to the Telnet service. The vulnerability arises from the `telnetd` process improperly validating the `USER` environment variable supplied by the client when it calls `/usr/bin/login`. Specifically, by crafting a malicious `USER` environment variable with a value like "-f root" and using the `telnet -a` or `--login` option, an attacker can trick the `login` program into skipping authentication, thereby granting access to the target host, potentially with root privileges. This issue is particularly relevant for systems running vulnerable versions of GNU Inetutils with Telnet enabled and exposed, including legacy Unix/Linux servers, embedded systems, and development environments.

Description: telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
Source: cve@mitre.org
NVD status: Analyzed
Products: inetutils, debian_linux

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: GNU InetUtils Argument Injection Vulnerability
Exploit added on: Jan 26, 2026
Exploit action due: Feb 16, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-88

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1A15FADC-AD86-4C11-B182-C1AC2D73A3BE",
            "versionEndIncluding": "2.7",
            "versionStartIncluding": "1.9.3",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.