CVE-2026-24061: Critical GNU InetUtils Telnetd Auth Bypass — Zero-Click Root Access

CVE-2026-24061 is a critical authentication bypass vulnerability affecting the telnet daemon (telnetd) in GNU InetUtils. The vulnerability exists due to improper neutralization of argument delimiters when handling the USER environment variable provided by the client. This flaw allows a remote, unauthenticated attacker to force the backend login program to log them in as the root user without providing a password. It is a textbook example of an Argument Injection leading to Privilege Escalation. The vulnerability affects GNU InetUtils versions 1.9.3 through 2.7, a widely deployed telnet implementation across Unix and Linux systems.

The vulnerability exploits the interaction between telnetd and the system's login binary. When a client connects, the Telnet protocol allows passing environment variables. GNU InetUtils telnetd accepts the USER variable and passes it directly to the command line of /bin/login. If an attacker sets the USER variable to '-f root', the command executed by the daemon effectively becomes: login -p -h <host> -f root. The -f flag tells the login program to skip authentication for the specified user (root). Because telnetd fails to sanitize this input, the attacker walks right through the front door. This is a classic argument injection vulnerability - user-controlled input (the USER environment variable) is passed unsanitized to a command-line argument, allowing the attacker to inject additional flags that fundamentally change the program's behavior.

CVSS Score: 9.8 (Critical) The impact is catastrophic for any system running the vulnerable service exposed to the internet: • Full System Compromise: Immediate root access to the server • No Authentication: No valid credentials are required • Legacy Protocol: Telnet is unencrypted, meaning even without this flaw, it is insecure. This vulnerability makes it a wide-open backdoor Real-world impact scenarios: - Industrial control systems (ICS/SCADA) still using Telnet for management - Network equipment (routers, switches) with Telnet enabled by default - Embedded devices and IoT systems with hard-coded Telnet services - Legacy Unix/Linux systems in enterprise environments - Remote access to critical infrastructure This vulnerability is particularly dangerous because it requires no user interaction and can be exploited with a simple Telnet client.

This vulnerability affects GNU InetUtils: • Version 1.9.3 • Up to and including Version 2.7 Note: Other telnetd implementations (like netkit-telnet) might not be affected, but GNU InetUtils is common across many Unix and Linux distributions. High-Risk Environments: • Industrial control systems (ICS/SCADA) using GNU telnetd • Network infrastructure devices with GNU InetUtils • Legacy enterprise servers running vulnerable versions • Embedded Linux systems with default GNU utilities • Any system with port 23 exposed to untrusted networks Even if your Telnet service is only accessible internally, it remains vulnerable to lateral movement attacks if an attacker gains initial access to your network.

We strongly recommend disabling Telnet entirely. It is an obsolete, insecure protocol. Use SSH instead. Option 1: Disable Telnetd (Recommended) Stop the service and disable it from starting on boot.

# For systemd based systems
sudo systemctl stop telnet.socket
sudo systemctl disable telnet.socket

# Or remove the package entirely
sudo apt-get remove inetutils-telnetd

Option 2: Patching If you absolutely must use telnet, upgrade GNU InetUtils to a version later than 2.7 (e.g., 2.8+) or apply the security patches provided by your OS vendor. To update GNU InetUtils:

If you are running an affected version of GNU InetUtils, you are likely vulnerable. Check your InetUtils version:

# Check telnetd version
telnetd --version

# Check if inetutils-telnetd package is installed
dpkg -l | grep inetutils-telnetd
rpm -qa | grep inetutils

TEPTEZ can automatically scan your infrastructure for this and other CVEs. Our platform identifies exposed services and provides remediation steps.