Researchers warn of unpatched, critical Telnetd flaw affecting all versions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd. Do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears. | 9.8 | 98% | KEV PoC ×4 |
| large≈10,000–100,000 internet-exposed telnetd instances (a subset of the several hundred thousand telnet port 23 devices observed in public internet scans); total… | |
| CVE-2026-32746 | Out-of-Bounds Write in GNU inetutils telnetd Enables Unauthenticated RCE GNU inetutils telnetd contains an out-of-bounds write (CWE-120) in the LINEMODE SLC (Set Local Characters) suboption handler, where the add_slc function writes into a fixed-size buffer without first checking whether it is full. A remote, unauthenticated attacker can trigger it by connecting to the telnet daemon and sending a crafted LINEMODE SLC suboption that overflows the buffer, with no user interaction or privileges required. Successful exploitation of the memory corruption can yield remote code execution with the privileges of telnetd or crash the daemon, consistent with the CVSS 9.8 critical score. All GNU inetutils versions through 2.7 are affected wherever telnetd is enabled. As of the latest reporting the flaw is unpatched, a public PoC/technical analysis exists, it is not yet listed in CISA KEV, and EPSS assigns a 23.7% chance of exploitation within 30 days (98th percentile), so no confirmed in-the-wild exploitation is known. Do: Inventory systems for the inetutils telnetd package and disable the daemon or restrict TCP port 23 to trusted networks, preferring SSH where possible. No fixed version is available yet, so monitor GNU inetutils announcements and the referenced bug-report thread and upgrade promptly once a patched release ships. In the interim, use firewall/ACL rules to prevent untrusted hosts from reaching telnetd. | 9.8 | 24% | PoC |
| moderatelikely tens of thousands of systems running inetutils telnetd (estimate; no public install counts) |
Full article529 words · extracted from securityaffairs.com · click to collapse
CVE-2026-32746 is a critical flaw in GNU InetUtils telnetd that allows remote attackers to execute code with elevated privileges
Cybersecurity company Dream disclosed a critical flaw, tracked as CVE-2026-32746 (CVSS score of 9.8), in GNU InetUtils telnetd that lets unauthenticated remote attackers execute code with elevated privileges. The issue stems from an out-of-bounds write in the LINEMODE handler, causing a buffer overflow.
The flaw affects all versions up to 2.7. A patch is expected by April 1, 2026, and users are urged to update as soon as it becomes available.
GNU InetUtils telnetd is a server component of GNU InetUtils that provides remote login access via the Telnet protocol. It allows users to connect to a system over a network and run commands remotely, though it’s largely outdated and insecure compared to modern alternatives like SSH.
“Dream Security uncovered a new buffer overflow vulnerability (CVE-2026-32746) in the GNU Inetutils telnetd daemon, specifically in the code that handles LINEMODE SLC (Set Local Characters) option negotiation.” reads the report published by Dream Security. “An unauthenticated remote attacker can exploit this by sending a specially crafted message during the initial connection handshake — before any login prompt appears. Successful exploitation can result in remote code execution as root. An initial report was sent to the GNU Inetutils security team following the discovery.”
The experts warn of the trivial exploitation of this issue, which can lead to complete system compromise.
Any system running vulnerable GNU Inetutils telnetd is affected, including Linux distributions, IoT devices, and legacy OT/ICS environments using Telnet. The flaw can be triggered remotely during the initial connection by sending a crafted request, requiring no authentication or user interaction, making exploitation straightforward and highly dangerous.
“Because telnetd typically runs as root (via inetd or xinetd ), successful exploitation yields complete host compromise, including but not limited to:
- Arbitrary remote code execution as root
- Persistent backdoor installation
- Sensitive data exfiltration
- Use of the host as a pivot point for further network intrusion
A single network connection to port 23 is sufficient to trigger the vulnerability. No credentials, no user interaction, and no special network position are required.” continues the advisory.
Experts recommend disabling Telnet services until a fix is available. To mitigate risk, block port 23, restrict access, and avoid running it as root. Enable network-level logging, packet capture, and IDS monitoring to detect exploitation attempts, and store logs centrally.
Dream researchers warn that, despite being outdated and insecure, Telnet is still widely used in ICS/OT and government systems with legacy infrastructure, where upgrades are costly or impractical, making these environments especially vulnerable to severe real-world impacts.
In January 2026, security researcher Kyu Neushwaistein (aka Carlos Cortes Alvarez) reported another critical vulnerability, tracked as CVE-2026-24061 (CVSS score of 9.8), in the GNU InetUtils telnet daemon (telnetd) that impacts all versions from 1.9.3 to 2.7.
The vulnerability can be exploited to gain root access on affected systems. The vulnerability was introduced as part of a source code commit made on March 19, 2015. The flaw remained undiscovered for nearly 11 years, posing long-standing security risks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GNU InetUtils telnetd)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/189620/hacking/researchers-warn-of-unpatched-critical-telnetd-flaw-affecting-all-versions.html