Skip to main content

Inetutils CVE-2026-24061

CRITICAL
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2026-01-21 cve@mitre.org
Authentication Bypass Debian Debian Linux Inetutils Gnu
9.8
CVSS 3.1 · Vendor: mitre
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to telnetd service
  2. Exploit
    Set USER environment variable to '-f root'
  3. Execution
    Bypass authentication mechanism
  4. Impact
    Gain root-level access

Vulnerability Assessment

Weakness
CWE
CWE-88
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
Exploitation Conditions

telnetd service must be running and accepting remote connections. GNU Inetutils version 2.7 or earlier with default authentication enabled. No authentication credentials required for exploitation.
Impact

CVSS 9.8 (Critical). EPSS 75.3% — very high exploitation probability. KEV-listed with active exploitation. Trivially exploitable with basic TELNET client. Public PoC available. Patch available. Root access without any credentials.
Exploit ScenarioDerived

An attacker connects to an exposed telnetd service and during the TELNET NEW-ENVIRON negotiation phase, sets the USER environment variable to '-f root'. The telnetd daemon passes this to login(1), which interprets '-f' as the flag to skip authentication for the 'root' user. The attacker is immediately granted a root shell without providing any password. The entire attack can be performed with: telnet -l '-froot' target_host.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 75.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain root access by setting the USER environment variable to '-f root' during TELNET negotiation. With EPSS 75% and KEV listing, this trivially exploitable vulnerability (CVE-2026-24061) has been widely weaponized. Public PoC is available and patches exist.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54 CVSS 9.8

GNU Inetutils telnetd fails to sanitize environment variables received during TELNET protocol negotiation (CWE-88), allowing remote attackers to inject the '-f root' flag that causes login(1) to skip authentication entirely and grant root access.

RemediationAI

Upgrade GNU Inetutils to patched version immediately. Better yet: disable telnetd entirely and use SSH instead. If telnet must remain, restrict access via firewall to trusted networks only. Audit systems for unauthorized access that may have occurred before patching.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

During TELNET NEW-ENVIRON option negotiation, the client can set environment variables that are passed to the login process. By setting USER to '-f root', the attacker exploits the fact that telnetd passes this value to login(1), where the '-f' flag means 'skip authentication for the specified user'. This is an argument injection attack — the USER value is interpreted as a command-line flag rather than a username. The vulnerability is trivial to exploit and requires no special tools.

Know when Inetutils gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Added to CISA KEV
Feb 11, 2026 - 15:40 cisa
CISA KEV
PoC Detected
Feb 11, 2026 - 15:40 vuln.today
Public exploit code
Patch released
Feb 11, 2026 - 15:40 nvd
Patch available
CVE Published
Jan 21, 2026 - 07:16 nvd
CRITICAL 9.8

DescriptionCVE.org

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Executive ViewAI

Why It Matters

Organizations using GNU Inetutils face critical risk from CVE-2026-24061 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score
7.2/10
Composite threat intelligence
EPSS Score
75.3%
Top 1% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
NVD CVE.org CISA KEV EPSS POC (2) Vendor Exploit-DB VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 75.3%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

209
Low Medium High Critical
KEV: +50
EPSS: +75
CVSS: +49
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

More in Inetutils

View all
CVE-2023-40303 HIGH POC
7.8 Aug 14

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions

CVE-2022-39028 HIGH POC
7.5 Aug 30

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v
CVE-2026-28372 HIGH POC
7.4 Feb 27

Inetutils versions up to 2.7 is affected by inclusion of functionality from untrusted control sphere (CVSS 7.4).
CVE-2026-32746 CRITICAL POC
9.8 Mar 13

OOB write in GNU inetutils telnetd through 2.7 via LINEMODE SLC handler.
CVE-2021-40491 MEDIUM
6.5 Sep 03

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they
CVE-2026-32772 LOW
3.4 Mar 13

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-86060 CRITICAL POC
9.2
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2
CVE-2026-40281 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Legacy 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
PATCH https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc PATCH https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ADVISORY https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html ADVISORY https://vuldb.com/vuln/342143 REF http://www.openwall.com/lists/oss-security/2026/01/22/1 REF https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html REF https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061 REF https://www.gnu.org/software/inetutils/ REF https://www.openwall.com/lists/oss-security/2026/01/20/2 REF https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER=' REF https://www.openwall.com/lists/oss-security/2026/01/20/8 REF https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package REF https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy