800K+ Telnet Servers Exposed to RCE Attacks – PoC Released
A critical authentication bypass vulnerability identified as CVE-2026-24061 in the telnetd component of GNU Inetutils has exposed approximately 800,000 internet-accessible Telnet instances to unauthenticated remote code execution (RCE). This…
A critical authentication bypass vulnerability identified as CVE-2026-24061 in the telnetd component of GNU Inetutils has exposed approximately 800,000 internet-accessible Telnet instances to unauthenticated remote code execution (RCE). This vulnerability has a CVSS score of 9.8 and allows attackers to gain root-level access without valid credentials, posing a severe risk to exposed infrastructure worldwide.
The vulnerability originates from an argument injection flaw present in telnetd versions 1.9.3 through 2.7. The telnetd server fails to sanitize the USER environment variable before it is passed to /usr/bin/login , allowing attackers to inject the string -f root and bypass authentication completely.
When an attacker connects using telnet with the USER set to -f root , the login process interprets the -f flag as a force-login parameter, automatically granting root access without performing authentication checks. This issue was introduced in a March 2015 source code commit and remained undetected for nearly 11 years across major Linux distributions, including Debian, Ubuntu, Kali Linux, and Trisquel.
Proof-of-concept exploits have been publicly released and are actively being used. GreyNoise detected real-world exploitation within 18 hours of public disclosure, capturing 1,525 packets across 60 Telnet sessions from 18 unique attacker IPs between January 21-22, 2026. The majority of attacks (83.3%) targeted root user access, with post-exploitation activities including SSH key persistence, system reconnaissance, and attempts to deploy malware.
The vulnerability originates from an argument injection flaw present in telnetd versions 1.9.3 through 2.7.
Organizations are advised to upgrade immediately to GNU InetUtils version 2.8 or later. For systems unable to upgrade, critical mitigations include:
Turning off the telnetd service entirely Blocking TCP port 23 at network perimeter firewalls Restricting Telnet access to trusted clients only
The Shadowserver Foundation’s Accessible Telnet Report can assist organizations in identifying exposed instances on their networks.
Based on reporting by Cyber Security News.