#security #CVE
CVE-2026-24061 CVSS 9.8
喜欢用 telnetd 的有福了！仅需要这样就能简单粗暴 RCE！
GNU InetUtils Security Advisory: remote authentication by-pass in telnetd
The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter. If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes. This happens because the telnetd server do not sanitize the USER environment variable before passing it on to login(1), and login(1) uses the -f parameter to by-pass normal authentication.
Severity: High Vulnerable versions: GNU InetUtils since version 1.9.3 up to and including version 2.7.
## Example On a Trisquel GNU/Linux 11 aramo laptop:
[email protected]:~ sudo apt-get install inetutils-telnetd telnet
[email protected]:~ sudo sed -i 's/#<off># telnet/telnet/' /etc/inetd.conf
[email protected]:~ sudo /etc/init.d/inetutils-inetd start
[email protected]:~ USER='-f root' telnet -a localhost ...
[email protected]:~#
https://www.openwall.com/lists/oss-security/2026/01/20/2
CVE-2026-24061 CVSS 9.8
喜欢用 telnetd 的有福了！仅需要这样就能简单粗暴 RCE！
GNU InetUtils Security Advisory: remote authentication by-pass in telnetd
The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter. If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes. This happens because the telnetd server do not sanitize the USER environment variable before passing it on to login(1), and login(1) uses the -f parameter to by-pass normal authentication.
Severity: High Vulnerable versions: GNU InetUtils since version 1.9.3 up to and including version 2.7.
## Example On a Trisquel GNU/Linux 11 aramo laptop:
[email protected]:~ sudo apt-get install inetutils-telnetd telnet
[email protected]:~ sudo sed -i 's/#<off># telnet/telnet/' /etc/inetd.conf
[email protected]:~ sudo /etc/init.d/inetutils-inetd start
[email protected]:~ USER='-f root' telnet -a localhost ...
[email protected]:~#
https://www.openwall.com/lists/oss-security/2026/01/20/2