mefhika120/ashwesker-cve-2026-24061Exploit for CVE-2026-24061, a critical remote authentication bypass in GNU InetUtils telnetd, allowing unauthenticated root access via crafted environment variables.
CVE-2026-24061 is a critical vulnerability affecting the telnetd service in GNU InetUtils.
It allows an unauthenticated remote attacker to log in as root by exploiting improper handling of environment variables passed to the system login process.
Impact: Complete system compromise. Severity: 🔥 Critical (CVSS 9.8)
telnetdIf telnet is enabled on your system and you're running these versions, you’re vulnerable.
The USER environment variable is not properly sanitized.
An attacker can pass crafted arguments (e.g., -f root) to bypass authentication entirely and gain root access.
No credentials. No user interaction. Just vibes — and they’re bad. 😬
Basic root bypass:
python3 CVE-2026-24061.py 192.168.1.100
Custom port/user:
python3 CVE-2026-24061.py vulnerable-host --port 2323 --user bin
[+] Auth bypass succeeded! Dropping into interactive shell...root@vulnerable-host:~$ where you can run commands (e.g., id → uid=0(root)...)telnetd --version
If the version is ≤ 2.7, patch ASAP.
| Field | Value |
|---|---|
| CVE | CVE-2026-24061 |
| Severity | Critical (9.8) |
| Type | Remote auth bypass |
| Impact | Root access |
| Fix | Patch / Disable telnet |
This information is provided for educational and defensive security purposes only. The authors do not condone or support unauthorized access, exploitation, or misuse of systems.
Always test and apply security practices only on systems you own or are explicitly authorized to assess. Use responsibly. Stay ethical. 🛡️