The issue is triggered through the interaction between Telnet's automatic login functionality and the handling of the USER environment variable.

The attacker-controlled value:

is not treated strictly as a username. Instead, it can become an argument to login, resulting in behavior equivalent to:

The -f option instructs login to bypass the normal authentication process for the specified user.

Proof of Concept PoC

The repository includes a Python 3 proof of concept that performs the Telnet connection, handles the required protocol negotiation, injects the malicious USER value, and verifies the resulting session.

Clone the repository (Recommended)

Download poc.py only

Usage

Make the PoC executable:

Run it by providing the target address and Telnet port:

Example:

Successful Exploitation

A vulnerable target produces output similar to:

CVE-2026-24061 - GNU Inetutils telnetd Auth Bypass

The PoC then provides an interactive session.

Privilege escalation can be confirmed with:

Expected result:

This confirms that the Telnet authentication mechanism was bypassed and the resulting session has root privileges.

PoC Workflow

The exploit performs the following operations:

Connects to the target Telnet service. Performs the required Telnet protocol negotiation. Enables the automatic-login behavior required for exploitation. Supplies the malicious USER=-f root value. Allows the vulnerable telnetd implementation to pass the manipulated value to login. Receives the resulting session. Provides an interactive terminal to the operator.

The PoC does not rely on credentials for the vulnerable authentication path.

Affected Configurations

Exploitation is dependent on the target configuration and the interaction between telnetd and the system's login implementation.

The primary conditions are:

GNU Inetutils telnetd within the affected version range.
Telnet service accessible to the attacker.
Automatic login functionality enabled or available.
Vulnerable handling of the USER environment variable.
A compatible login implementation capable of interpreting the injected option.

Consequently, the presence of an affected Inetutils version alone should not be treated as proof of exploitability. Distribution patches and service configuration must also be considered.

Impact

CVE-2026-24061 can completely compromise a vulnerable system.

Depending on the privileges under which telnetd operates, exploitation may provide:

Authentication bypass
Unauthorized local account access
Remote command execution
Privilege escalation
Root-level access
Complete system compromise

The highest-risk scenario is a remotely accessible Telnet service where exploitation results in a root session.

Detection

Potential indicators of exploitation include:

Unexpected connections to TCP/23.
Telnet authentication attempts using unusual usernames.
Suspicious USER values beginning with command-line options.
Unexpected login process arguments.
Root sessions originating from telnetd.
Unexpected processes spawned by the Telnet service.

Network monitoring should also identify systems unnecessarily exposing Telnet services.

Mitigation

The recommended response is to remove Telnet and use SSH for remote administration.

If Telnet cannot immediately be removed:

Upgrade to a vendor-provided version containing the security fix.
Apply the appropriate operating-system security update.
Restrict TCP/23 to trusted management networks.
Prevent direct exposure of Telnet to untrusted networks.
Monitor Telnet authentication and process activity.

Because Linux distributions may backport security fixes without changing the upstream version number, administrators should verify the security status of their distribution package rather than relying solely on the displayed version.

Validation

The vulnerability was successfully reproduced against a vulnerable GNU Inetutils Telnet service running on Ubuntu 22.04.5 LTS.

The PoC established a connection to TCP/23, injected:

and obtained a root session.

Privilege verification returned:

This provides direct confirmation of the security impact.

Disclaimer

This proof of concept is provided for security research, vulnerability validation, authorized penetration testing and educational purposes.

Only test systems for which you have explicit authorization.

Gabriel D. Ishengoma
Offensive Security · Cybersecurity Research · Digital Forensics