CVE-2026-24061

On systems where login accepts the -f flag (force login without password verification), this results in an unauthenticated root session being granted to the remote attacker.

This vulnerability class has historical precedent: CVE-2001-0797 in SysV telnetd and the well-known Linux telnetd -f bypass from 1994 exploited the same fundamental failure to sanitize environment-sourced arguments passed to privileged binaries.

No credentials required. No prior access needed. A single network packet sequence achieves root.

Technical Analysis

Root Cause

GNU InetUtils telnetd processes NEW-ENVIRON (option code 0x27, per RFC 1572) sub-negotiation to collect client-supplied environment variables. These variables are assembled into an argument vector and passed to execve(2) when spawning login(1).

The vulnerability is triggered as follows:

1. The server sends IAC DO NEW-ENVIRON, soliciting environment variables from the client.
2. The malicious client replies with IAC WILL NEW-ENVIRON.
3. The server follows with IAC SB NEW-ENVIRON SEND IAC SE.
4. The client sends the injected payload:

5. telnetd constructs the login invocation as login -f root.
6. login(1) interprets -f as "force login, skip authentication" and logs in the specified user (root) without requiring a password.

Protocol-Level Breakdown

Why -f root Works

The login(1) binary on many Linux systems accepts the -f <user> flag for "pre-authenticated" logins, historically used by terminal multiplexers and rlogin. When telnetd builds its exec call and fails to strip leading hyphens or validate option-like strings in environment variable values, it inadvertently passes attacker-controlled flags directly to login.

The effective call becomes:

Attack Scenario

Prerequisites:

• Target system running GNU InetUtils telnetd (TCP/23 open)
• Unpatched version of inetutils
• login(1) binary supports the -f flag (standard on most Linux distributions)
• No firewall blocking TCP/23

Affected Versions

Verify whether your distribution ships a patched version. Many modern systems have Telnet disabled by default; exposure requires an explicitly running telnetd.

CVSS Score

MITRE ATT&CK Mapping

Installation

Requirements: Python 3 (standard library only, zero external dependencies).

No pip install needed. Both scripts use only the Python standard library.

Project Structure

• poc_cve_2026_24061.py: Minimal, readable, educational. One target, one function, zero abstraction. Read this to understand exactly how the vulnerability works at the protocol level.
• cve_2026_24061.py: Industrialized exploit for pentesting engagements. Multithreaded, supports CIDR ranges, file input, CSV/JSON export, quiet mode, custom users.

Usage

Simple PoC (poc_cve_2026_24061.py)

Exploit a single host. The code is deliberately minimal so you can read it top to bottom and understand the full attack chain.

Industrialized Exploit (cve_2026_24061.py)

Single Host

CIDR Range (Mass Scan)

File Input

JSON Export

Custom Target User

Quiet Mode (pipe-friendly)

Full Options

Output Statuses

CSV output columns: ip:port, status, message

PoC Behavior

The script implements the full Telnet NEW-ENVIRON negotiation state machine natively in Python without relying on external Telnet libraries:

1. Opens a raw TCP socket to the target on port 23 (configurable).
2. Reads incoming IAC command sequences and responds to DO NEW-ENVIRON with WILL NEW-ENVIRON.
3. Upon receiving the server SB NEW-ENVIRON SEND sub-negotiation, transmits the injected payload (USER = "-f root").
4. Monitors the response buffer for indicators of successful root login: presence of uid=0(root) or a shell prompt (#), in the absence of Login incorrect or Password:.
5. If the payload was injected, sends id\n and checks for uid=0(root) in the response as secondary confirmation.

Results are logged to stdout with color-coded status labels. Optional CSV export records all findings for post-processing.

Remediation and Mitigation

Immediate Actions

1. Disable Telnet entirely. Telnet transmits all data in cleartext. Replace with SSH.

   root@kitploit:~

   sudo systemctl disable telnet.socket --now
   sudo systemctl disable inetd --now
   

2. Apply vendor patch. Install the patched version of inetutils from your distribution once available.

3. Block TCP/23 at perimeter. Apply firewall rules to deny inbound Telnet connections.

   root@kitploit:~

   # iptables
   sudo iptables -A INPUT -p tcp --dport 23 -j DROP
   # nftables
   sudo nft add rule inet filter input tcp dport 23 drop
   

Defense in Depth

Detection (SIEM/IDS)

Snort/Suricata rule skeleton for detecting the exploit in transit:

Threat Intelligence

This repository ships pre-generated threat intel artifacts, ready to import into your SOC/CTI stack. They are auto-generated by CI from the actual exploit payload - if the payload changes, the artifacts update.

MISP

Import indicators/misp_event.json directly into any MISP instance:

The event contains: CVE ID, CVSS vector, Snort signature, payload hex, MITRE ATT&CK tags (T1190, T1548, T1059), CPE, and external references.

STIX 2.1

Import indicators/stix_bundle.json into OpenCTI, TAXII servers, or any STIX 2.1 consumer.

The bundle contains 11 objects: Vulnerability, Indicator (network pattern), 3 Attack Patterns (MITRE), Course of Action (remediation), Identity, and Relationships linking them.

IDS Signatures

Pre-built rules in signatures/:

• snort.rules - 3 Snort/Suricata rules (exploit attempt, generic -f injection, post-exploitation root shell)
• sigma.yml - Sigma rule for SIEM correlation

Regenerate

If you modify the exploit payload, regenerate all artifacts:

References: MISP - OpenCTI - STIX 2.1 - Sigma

References

• GNU InetUtils Official Repository
• RFC 1572 - Telnet Environment Option (NEW-ENVIRON)
• RFC 854 - Telnet Protocol Specification
• CVE-2001-0797 - Historical SysV telnetd -f bypass (precedent)
• MITRE ATT&CK - T1190: Exploit Public-Facing Application
• MITRE ATT&CK - T1548: Abuse Elevation Control Mechanism
• MISP Project
• Linux login(1) man page

Legal Disclaimer

This tool is provided for authorized security auditing, academic research, and educational purposes only. Usage against systems without explicit written permission from the system owner is illegal under applicable computer fraud and abuse laws (including but not limited to the CFAA, Computer Misuse Act, and equivalent legislation). The author accepts no liability for unauthorized or malicious use.