CVE-2026-24061
📋 TL;DR
This vulnerability in GNU Inetutils telnetd allows remote attackers to bypass authentication by setting the USER environment variable to '-f root'. This affects all systems running vulnerable versions of GNU Inetutils with telnetd enabled, potentially allowing unauthorized root access.
💻 Affected Systems
- GNU Inetutils
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains root shell access to vulnerable system, leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Attackers gain unauthorized root access to internet-facing telnet servers, enabling credential harvesting, lateral movement, and deployment of malware.
If Mitigated
If telnet is disabled or network-restricted, impact is limited to internal attackers with network access to telnet service.
🎯 Exploit Status
Exploit requires sending specially crafted USER environment variable. No authentication required. Simple command-line tools can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.7
Vendor Advisory: https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
Restart Required: Yes
Instructions:
1. Update GNU Inetutils to version after 2.7. 2. Apply patches from provided commit references. 3. Restart telnetd service or reboot system.
🔧 Temporary Workarounds
Disable telnetd service
linuxCompletely disable the vulnerable telnet daemon
systemctl disable telnetd
systemctl stop telnetd
Network firewall restriction
linuxBlock telnet port (23) at network perimeter
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Disable telnetd service immediately
- Implement strict network segmentation to isolate telnet servers
🔍 How to Verify
Check if Vulnerable:
Check if telnetd is running and version is 2.7 or earlier: 'telnetd --version' or check package managerCheck Version:
telnetd --version 2>&1 | grep -i versionVerify Fix Applied:
Verify telnetd version is after 2.7 and test authentication bypass no longer works📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with unusual USER values
- Successful logins with '-f root' in USER field
- Telnet connections from unexpected sources
Network Indicators:
- Telnet traffic to port 23 with unusual payloads
- Multiple failed login attempts followed by successful root access
SIEM Query:
source="telnetd" AND (USER="-f root" OR auth_failure AND USER contains "-")🔗 References
- https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
- https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
- https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
- https://www.gnu.org/software/inetutils/
- https://www.openwall.com/lists/oss-security/2026/01/20/2
- https://www.openwall.com/lists/oss-security/2026/01/20/8
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package
- https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package
- http://www.openwall.com/lists/oss-security/2026/01/22/1
- https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061
- https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html
- https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='
