Attackers Leveraging telnetd Exploit for Root Privileges After PoC Goes Public

Cybersecurity: Critical Authentication Bypass Vulnerability in GNU InetUtils Telnetd

A critical authentication bypass vulnerability has been identified in GNU InetUtils telnetd, allowing remote attackers to gain root access without authentication. This vulnerability is actively being exploited following the public release of proof-of-concept code.

Vulnerability Details

Severity High

Affected Versions GNU InetUtils 1.9.3 to 2.7

Attack Vector Network (TCP port 23)

Authentication Required None

Privileges Gained Root access

Date Disclosed Tue, Jan 20, 2026

The vulnerability arises from how telnetd constructs the login command template. In the telnetd/telnetd.c file, the login invocation uses the pattern: PATH_LOGIN " -p -h %h %?u{-f %u}{%U}" . The %U variable expands to the value of the USER environment variable received from the client without any sanitization.

Attackers exploit this by sending Telnet IAC (Interpret As Command) negotiation packets that embed the malicious USER variable during the initial connection handshake. A typical exploit payload includes terminal speed configuration, a terminal type declaration, and the critical USER.-f root parameter.

The flaw was discovered by researcher Kyu Neushwaistein and officially reported by Simon Josefsson, with patches made available immediately. Security monitoring platforms detected widespread exploitation attempts shortly after the proof-of-concept publication.

Security researchers identified multiple distinct payload variants, indicating the use of diverse exploitation toolkits:

Terminal Speed Configurations:

9600,9600 baud (2 attacker sources) 38400,38400 baud (7 attacker sources) 0,0 baud/no negotiation (3 attacker sources) Unspecified (7 sources with minimal payloads)

Terminal Type Declarations:

XTERM-256COLOR (5 sources, uppercase variant) xterm-256color (3 sources, lowercase variant) screen-256color (1 source using GNU Screen multiplexer) UNKNOWN (4 sources with generic terminal types)

The majority of attackers targeted root accounts directly, with some attempting to exploit low-privilege accounts. Some attacks revealed infrastructure details, suggesting the use of Kali Linux penetration testing distributions and shared VPS environments.

Organizations are advised to audit their networks for exposed telnet services and review authentication logs for suspicious root login attempts. Any successful exploitation requires a complete system compromise response, including forensic analysis, credential rotation, and system rebuilding.

Based on reporting by GBHackers.