Hackers exploit critical telnetd auth bypass flaw to get root
Recorded: Jan. 23, 2026, 5 p.m.
| Original | Summarized |
Hackers exploit critical telnetd auth bypass flaw to get root News Featured Curl ending bug bounty program after flood of AI slop reports INC ransomware opsec fail allowed data recovery for 12 US orgs Cisco fixes Unified Communications RCE zero day exploited in attacks Hackers exploit 29 zero-days on second day of Pwn2Own Automotive US to deport Venezuelans who emptied bank ATMs using malware Hackers exploit critical telnetd auth bypass flaw to get root What an AI-Written Honeypot Taught Us About Trusting Machines Microsoft: Outlook for iOS crashes, freezes due to coding error Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers exploit critical telnetd auth bypass flaw to get root Hackers exploit critical telnetd auth bypass flaw to get root By Bill Toulas January 23, 2026 A coordinated campaign has been observed targeting a recently disclosed critical-severity vulnerability that has been present in the GNU InetUtils telnetd server for 11 years. The flaw occurs because telnetd passes the user-controlled USER environment variable directly to login(1) without sanitization. By setting USER to -f root and connecting with the telnet -a command, an attacker can skip authentication and obtain root access. telnet still used to connect to old devices Observed activitySource: GreyNoise 7 Security Best Practices for MCP Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Fortinet admins report patched FortiGate firewalls getting hacked Hackers breach Fortinet FortiGate devices, steal firewall configs Zendesk ticket systems hijacked in massive global spam wave Sponsor Posts Discover how phishing kits are sold and deployed. Download the full research report. Exposure Management Index: Insights From 3,000+ Teams. Get The Report. Overdue a password health-check? Audit your Active Directory for free Identity Governance & Threat Detection in one: Get a guided tour of our platform Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers Exploit Critical Telnetd Auth Bypass Flaw to Gain Root Access A coordinated campaign has emerged targeting a longstanding, critical-severity vulnerability present in the GNU InetUtils telnetd server since 2015. Tracked as CVE-2026-24061, this vulnerability was publicly disclosed on January 20, 2026, and swiftly leveraged by malicious actors. The flaw stems from a remote-authentication bypass within the GNU InetUtils component, specifically related to the unsanitized handling of environment variables when spawning the `/usr/bin/login` command. The core issue lies in telnetd’s direct passage of the user-controlled `USER` environment variable to the `login(1)` command, without any sanitization. Attackers can exploit this by setting the `USER` variable to `-f root` and utilizing the telnet -a command to bypass authentication and gain root access. Affected versions of GNU InetUtils range from 1.9.3 (released in 2015) through 2.7, with version 2.8 providing a remediation. Users unable to upgrade can mitigate the risk by disabling the telnetd service or implementing TCP port 23 blocking across all firewalls. GNU InetUtils is a collection of classic network client and server tools, including telnet/telnetd, ftp/ftpd, rsh/rshd, ping, and traceroute. Maintained by the GNU Project, it’s found across various Linux distributions and remains prevalent due to its simplicity and low overhead. Despite telnet being an inherently insecure legacy component largely replaced by SSH, its presence persists, particularly in the industrial sector, driven by its ease of use. The vulnerability is amplified by the continued use of telnet on legacy and embedded devices, sometimes untouched for over a decade. This includes IoT devices, cameras, and industrial sensors within Operational Technology (OT) networks – scenarios where updates are infrequent. Furthermore, continued reliance on telnet for specific projects – such as connecting to older Cisco devices beyond their end-of-life – highlights the vulnerability. GreyNoise, a threat monitoring firm, has confirmed real-world exploitation activity leveraging CVE-2026-24061, observed between January 21 and 22. The activity involved 18 unique attacker IPs across 60 Telnet sessions, flagged as 100% malicious, transmitting 1,525 packets totaling 101.6 KB. Initial investigations suggest an automated nature to much of the activity, though some instances of “human-at-keyboard” manipulation were noted. The attacks deployed the Telnet IAC option negotiation to inject `USER=-f <user>` and grant shell access without authentication. Observations revealed that, in 83.3% of cases, the attacks targeted the `root` user. Post-exploitation, the attackers engaged in automated reconnaissance and attempted to persist SSH keys and deploy Python malware. These attempts ultimately failed due to missing binaries or directories on the targeted systems. Despite the seemingly limited scope and success rate of the exploitation activity, mitigation strategies as recommended remain crucial. The rapid disclosure and practical exploitation underscore the ongoing need for vigilance, particularly within environments relying on legacy systems or OT networks. |