CVE-2026-24061 Scanner: GNU Inetutils Telnet Exploit Checker

CVE-2026-24061 Scanner is a Bash Script-based tool for performing detection (reconnaissance) and active verification (active exploitation check) of the Authentication Bypass vulnerability in the telnetd service of the GNU Inetutils package.

This vulnerability allows an attacker to perform Argument Injection through the USER environment variable to force a login as root without a password.

⚠️ WARNING: This tool is designed for educational purposes, internal security audits, and authorized Red Teaming. Unauthorized use on systems that are not yours is illegal.

📋 Features

• Subnet Scanning: Scans an entire subnet (/24) in parallel for time efficiency.

• Banner Grabbing: Detects Telnet services and filters targets based on banner (looking for "GNU" or "inetutils" indicators).

• Active Verification Mode: Automatically attempts to inject the USER="-f root" payload to verify whether the system is actually vulnerable (not just matching versions).

• Full Logging: Records all scan results (Safe, Vulnerable, or Open Port) into the telnet_exploit_results.txt log file.

• Smart Sanitization: Handles IP/CIDR input formats automatically.

• Shodan Intel: Includes cross-references to the Shodan CVE database.

🛠️ Prerequisites (Dependencies)

This script requires standard Linux networking tools. Make sure your system has:

• bash (Standard shell)

• nc (Netcat - OpenBSD variant recommended)

• telnet (Telnet client - Required for exploitation mode)

To install on Debian/Ubuntu/Kali Linux:

sudo apt update
sudo apt install netcat-openbsd telnet

🚀 Usage

1. Clone the Repository (or download the script):

   root@kitploit:~

   git clone [https://github.com/username-anda/CVE-2026-24061-Scanner.git](https://github.com/username-anda/CVE-2026-24061-Scanner.git)
   cd CVE-2026-24061-Scanner
   
   

2. Grant Execute Permission:

   root@kitploit:~

   chmod +x telnet_scanner.sh
   
   

3. Run the Script:

   root@kitploit:~

   ./telnet_scanner.sh
   
   

4. Follow the On-Screen Instructions:

   • Enter the Target Subnet (e.g., 192.168.1.1 or 10.10.10.0/24).

   • Enter the Port (Default: 23).

📊 Output Interpretation

The script will produce colored output in the terminal and a log file:

• [PWNED] (RED): Target is VULNERABLE. The script successfully gained root access without a password. PATCH IMMEDIATELY!

• [VULN-LIKELY] (MAGENTA): Banner indicates GNU Inetutils, but automatic exploitation failed (possibly due to firewall, special configuration, or partial patch). Manual investigation is required.

• [SAFE] (GREEN): Port is open, but the banner indicates other software (Cisco, Microsoft, BusyBox) that is not affected by this CVE.

• [OPEN] (GREEN): Port is open with no clear banner.

📝 Example Log

Scan results will be saved to telnet_exploit_results.txt:

Scan Report - Started at Mon Jan 26 14:00:00 WIB 2026
-----------------------------------------------------
[SAFE] Host: 192.168.1.1 | Banner: Cisco IOS Software (Not GNU)
[PWNED] Host: 192.168.1.50 | AUTH BYPASSED | Root Shell Confirmed!
[OPEN] Host: 192.168.1.102 | Port Open but No Banner

🛡️ Mitigation (Remediation)

If you find a vulnerable host:

1. Disable Telnet: Replace Telnet usage with SSH entirely. Telnet sends data (including passwords) in cleartext.

2. Update the Package: Update inetutils-telnetd to the latest version patched by your distribution maintainer.

3. Firewalling: Restrict access to Port 23 only from trusted management IPs, or block it entirely from the public internet.

⚖️ Disclaimer

The author is not responsible for any misuse of this tool. This script is provided "as is" without any warranty. Users are fully responsible for all actions taken using this tool. Comply with the cybersecurity laws and regulations applicable in your country.

Author: ittampan

Reference: CVE-2026-24061 Details | Shodan Dorks