{"id":"CVE-2026-24061","published":"2026-01-21T07:16:01Z","modified":"2026-09-30T11:47:02Z","title":"GNU InetUtils Argument Injection Vulnerability","vendor":"GNU","product":"InetUtils","tier":"core","eol":null,"description":{"text":"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.","provenance":"source","from":"NVD"},"summary":{"text":"The telnetd daemon in GNU InetUtils, through version 2.7, contains an argument injection flaw in how it handles the USER environment variable. An attacker with network access to the service can supply a crafted \"-f root\" value for USER, bypassing authentication without requiring credentials or any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:19Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98984,"percentile":0.9993,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-01-26","dueDate":"2026-02-16","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cgit.git.savannah.gnu.org/cgit/inetutils.git ; https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc; https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ; https://nvd.nist.gov/vuln/detail/CVE-2026-24061","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-01-22","exploitedFirstSeen":"2026-01-22","ransomware":true,"evidence":[{"url":"https://viz.greynoise.io/tags/gnu-inetutils-telnetd-authentication-bypass-cve-2026-24061-attempt","date":"2026-01-22"},{"url":"https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html","date":"2026-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-23&host_type=src&vulnerability=cve-2026-24061","date":"2026-01-23"},{"url":"https://beelzebub.ai/blog/catching-cve-2026-24061-in-the-wild/","date":"2026-01-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-01-26"},{"url":"https://x.com/csirt_it/status/2015699152831721900","date":"2026-01-26"},{"url":"https://www.greynoise.io/blog/active-ivanti-exploitation","date":"2026-02-10"},{"url":"https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/","date":"2026-02-10"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"},{"url":"https://ctrlaltintel.com/research/Qilin/","date":"2026-05-01"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-88","name":"Improper Neutralization of Argument Delimiters in a Command"}],"references":[{"url":"https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc","tags":["Patch"]},{"url":"https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b","tags":["Patch"]},{"url":"https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html","tags":["Mitigation","Vendor Advisory"]},{"url":"https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.gnu.org/software/inetutils/","tags":["Product"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/20/2","tags":["Mailing List"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/20/8","tags":["Mailing List"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package","tags":["Mitigation","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/01/22/1","tags":["Mailing List"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00025.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24061","tags":["US Government Resource"]},{"url":"https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/20/2#:~:text=root@...a%3A~%20USER='","tags":["Mailing List","Third Party Advisory"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated network service exploitation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass","start":0,"end":72}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: authentication bypass yields valid session as root","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote authentication bypass via a","start":37,"end":78}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-3688","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3688","exploited":true,"exploitedSince":"2026-01-26","provenance":"source"},"exploits":[{"id":52524,"url":"https://www.exploit-db.com/exploits/52524","title":"GNU InetUtils 2.6 - Telnetd Remote Privilege Escalation","type":"local","platform":"linux","date":"2026-04-29","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-04-29"},"pocGithub":{"count":56,"skipped":12,"earliest":"2026-01-21","earliestUrl":"https://github.com/leonjza/inetutils-telnetd-auth-bypass","repos":[{"name":"SafeBreach-Labs/CVE-2026-24061","url":"https://github.com/SafeBreach-Labs/CVE-2026-24061","stars":209,"created":"2026-01-22"},{"name":"JayGLXR/CVE-2026-24061-POC","url":"https://github.com/JayGLXR/CVE-2026-24061-POC","stars":69,"created":"2026-01-22"},{"name":"ZeroDayEvil/CVE-2026-24061","url":"https://github.com/ZeroDayEvil/CVE-2026-24061","stars":22,"created":"2026-09-28"},{"name":"parameciumzhang/Tell-Me-Root","url":"https://github.com/parameciumzhang/Tell-Me-Root","stars":21,"created":"2026-01-22"},{"name":"Lingzesec/CVE-2026-24061-GUI","url":"https://github.com/Lingzesec/CVE-2026-24061-GUI","stars":17,"created":"2026-01-26"}]},"metasploit":[{"name":"GNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061","module":"exploit/linux/telnet/gnu_inetutils_auth_bypass","type":"exploit","disclosureDate":"2026-01-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb"}],"first":{"date":"2026-01-21","source":"PoC-in-GitHub","url":"https://github.com/leonjza/inetutils-telnetd-auth-bypass"},"provenance":"source"},"exploitRefs":["https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass","https://www.labs.greynoise.io/grimoire/2026-01-22-f-around-and-find-out-18-hours-of-unsolicited-houseguests/index.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2026-01-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24061","provenance":"source"},{"date":"2026-01-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-01-26, Exploit-DB 2026-04-29","url":"https://github.com/leonjza/inetutils-telnetd-auth-bypass","provenance":"source"},{"date":"2026-01-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://viz.greynoise.io/tags/gnu-inetutils-telnetd-authentication-bypass-cve-2026-24061-attempt","provenance":"source"},{"date":"2026-01-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-01-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3688","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":5},"priority":{"score":84.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 282 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9993"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 56 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}