CVE-2026-24061

Name of the Vulnerable Software and Affected Versions GNU Inetutils versions 1.9.3 through 2.7

Description An argument injection flaw exists in the telnetd server due to improper neutralization of argument separators when processing the USER environment variable. A remote attacker can bypass authentication and gain root-level access by providing a specially crafted value, such as -f root, for the USER variable while using the automatic login option. This occurs because the server passes the unsanitized USER value as an argument to the /usr/bin/login function, where the -f flag allows the system to skip interactive authentication. Exploitation attempts have been observed by GreyNoise, and the issue is particularly critical for legacy IoT devices, embedded systems, and Linux/UNIX machines where Telnet remains enabled.

Recommendations Update GNU Inetutils to version 2.7-2 or later. As a temporary mitigation, disable the telnetd service if it is not essential. Restrict access to the telnetd service to trusted IP ranges. Replace the Telnet protocol with SSH to ensure encrypted communications and stronger authentication.