Ancient telnet bug happily hands out root to attackers

A recently disclosed critical vulnerability in the GNU InetUtils telnet daemon (telnetd) is "trivial" to exploit, experts say. The bug, which had gone unnoticed for nearly 11 years, was disclosed on January 20 and is tracked as CVE-2026-24061 (9.8). It was introduced in a May 2015 update, and if you're one of the few to still be running telnetd, patch up, because attacks are already underway. GreyNoise data shows that in the past 24 hours, 15 unique IPs were trying to execute a remote authentication bypass attack by using the vulnerability. The security advisory explains that the bug allows attackers to easily gain root access to a target system. "The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter," wrote GNU contributor Simon Josefsson. "If the client supply [sic] a carefully crafted USER environment value being the string '-f root', and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes." Stephen Fewer, senior principal researcher at Rapid7, told The Register the vulnerability has "a number of worrying factors." The nature of the vulnerability, an argument injection flaw, means exploitation attempts are likely to be more reliable compared to more complex types, like memory corruption bugs, for example. The ease with which an attac...