Gnu · Inetutils · CVE-2026-24061
**Name of the Vulnerable Software and Affected Versions**
GNU Inetutils versions 1.9.3 through 2.7
**Description**
An argument injection flaw exists in the `telnetd` server due to improper neutralization of argument separators when processing the `USER` environment variable. A remote attacker can bypass authentication and gain root-level access by providing a specially crafted value, such as `-f root`, for the `USER` variable while using the automatic login option. This occurs because the server passes the unsanitized `USER` value as an argument to the `/usr/bin/login` function, where the `-f` flag allows the system to skip interactive authentication. Exploitation attempts have been observed by GreyNoise, and the issue is particularly critical for legacy IoT devices, embedded systems, and Linux/UNIX machines where Telnet remains enabled.
**Recommendations**
Update GNU Inetutils to version 2.7-2 or later.
As a temporary mitigation, disable the `telnetd` service if it is not essential.
Restrict access to the `telnetd` service to trusted IP ranges.
Replace the Telnet protocol with SSH to ensure encrypted communications and stronger authentication.