Critical Unpatched Telnetd Flaw (CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-24061 | Argument Injection Authentication Bypass in GNU Inetutils telnetd GNU Inetutils telnetd, in all versions through 2.7, contains an argument injection flaw (CWE-88) in its handling of the USER environment variable: a remote, unauthenticated attacker who supplies a crafted value of "-f root" for USER during a telnet session can bypass authentication entirely. An attacker gains command execution as root on the target host with no credentials, yielding full compromise (CVSS 3.1: 9.8). Any Linux system or distribution shipping the affected telnetd is exposed — most notably Debian through its inetutils package — and reporting indicates the flaw has existed for roughly 11 years and is currently unpatched in all versions. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-26, carries a 98% EPSS score (100th percentile), public PoC exploits exist, and GreyNoise has documented observed attacker activity against telnetd. Do: Inventory Linux hosts (especially Debian) for GNU Inetutils telnetd listening on port 23 and disable the telnet service or restrict it with firewall rules, since the flaw is reported unpatched in all versions through 2.7 and no fixed version is confirmed in the available data. As a CISA KEV entry (added 2026-01-26), apply vendor mitigations per BOD 22-01 guidance or discontinue use if mitigations are unavailable. Watch telnetd logs for sessions setting USER to values like "-f root", and monitor GNU/Debian channels for a patched release to deploy as soon as it appears. | 9.8 | 98% | KEV PoC ×4 |
| large≈10,000–100,000 internet-exposed telnetd instances (a subset of the several hundred thousand telnet port 23 devices observed in public internet scans); total… | |
| CVE-2026-32746 | Out-of-Bounds Write in GNU inetutils telnetd Enables Unauthenticated RCE GNU inetutils telnetd contains an out-of-bounds write (CWE-120) in the LINEMODE SLC (Set Local Characters) suboption handler, where the add_slc function writes into a fixed-size buffer without first checking whether it is full. A remote, unauthenticated attacker can trigger it by connecting to the telnet daemon and sending a crafted LINEMODE SLC suboption that overflows the buffer, with no user interaction or privileges required. Successful exploitation of the memory corruption can yield remote code execution with the privileges of telnetd or crash the daemon, consistent with the CVSS 9.8 critical score. All GNU inetutils versions through 2.7 are affected wherever telnetd is enabled. As of the latest reporting the flaw is unpatched, a public PoC/technical analysis exists, it is not yet listed in CISA KEV, and EPSS assigns a 23.7% chance of exploitation within 30 days (98th percentile), so no confirmed in-the-wild exploitation is known. Do: Inventory systems for the inetutils telnetd package and disable the daemon or restrict TCP port 23 to trusted networks, preferring SSH where possible. No fixed version is available yet, so monitor GNU inetutils announcements and the referenced bug-report thread and upgrade promptly once a patched release ships. In the interim, use firewall/ACL rules to prevent untrusted hosts from reaching telnetd. | 9.8 | 24% | PoC |
| moderatelikely tens of thousands of systems running inetutils telnetd (estimate; no public install counts) |
Full article620 words · extracted from thehackernews.com · click to collapse
Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges.
The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set Local Characters (SLC) suboption handler that results in a buffer overflow, ultimately paving the way for code execution.
Israeli cybersecurity company Dream, which discovered and reported the flaw on March 11, 2026, said it affects all versions of the Telnet service implementation through 2.7. A fix for the vulnerability is expected to be available no later than April 1, 2026.
"An unauthenticated remote attacker can exploit this by sending a specially crafted message during the initial connection handshake — before any login prompt appears," Dream said in an alert. "Successful exploitation can result in remote code execution as root."
"A single network connection to port 23 is sufficient to trigger the vulnerability. No credentials, no user interaction, and no special network position are required."
The SLC handler, per Dream, processes option negotiation during the Telnet protocol handshake. But given that the flaw can be triggered before authentication, an attacker can weaponize it immediately after establishing a connection by sending specially crafted protocol messages.
Successful exploitation could result in complete system compromise if telnetd runs with root privileges. This, in turn, could open the door to various post-exploitation actions, including the deployment of persistent backdoors, data exfiltration, and lateral movement by using the compromised hosts as pivot points.
"An unauthenticated attacker can trigger it by connecting to port 23 and sending a crafted SLC suboption with many triplets," according to Dream security researcher Adiel Sol.
"No login is required; the bug is hit during option negotiation, before the login prompt. The overflow corrupts memory and can be turned into arbitrary writes. In practice, this can lead to remote code execution. Because telnetd usually runs as root (e.g., under inetd or xinetd), a successful exploit would give the attacker full control of the system."
In the absence of a fix, it's advised to disable the service if it's not necessary, run telnetd without root privileges where required, block port 23 at the network perimeter and host-based firewall level to restrict access, and isolate Telnet access.
The disclosure comes nearly two months after another critical security flaw was disclosed in GNU InetUtils telnetd (CVE-2026-24061, CVSS score: 9.8) that could be leveraged to gain root access to a target system. The vulnerability has since come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency.
Update
Data from attack surface management platform Censys shows that there are about 3,362 exposed hosts as of March 18, 2026.
In a follow-up analysis, watchTowr Labs said the vulnerability affects a wide range of software, including FreeBSD, NetBSD, Citrix NetScaler, Haiku, TrueNAS Core, uCLinux, libmtev, and DragonFlyBSD. The cybersecurity company also described CVE-2005-0469 as CVE-2026-32746's doppelgänger, but on the client side.
The analysis has also revealed that while reliable remote code execution is difficult and environment-specific, the vulnerability can facilitate memory corruption, pointer leaks, and arbitrary writes in some cases. That said, the exact impact remains unclear, as the underlying code has been reused and modified across various platforms, particularly legacy and embedded environments.
"The most striking thing about this vulnerability is its sheer reach," researchers McCaulay Hudson and Aliz Hammond said. "A good portion of the huge number of systems running some kind of Telnet server includes this vulnerable code."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/03/critical-telnetd-flaw-cve-2026-32746.html