CVE-2026-24061 | telnetd in GNU Inetutils through 2.7 allows remote authentic… | CVSS 9.8 CRITICAL

Description

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Metadata

CVE ID: CVE-2026-24061
State: PUBLISHED
Assigner: mitre
Reserved: 2026-01-21 06:42 UTC
Published: 2026-01-21 06:42 UTC
Last updated: 2026-03-25 13:31 UTC
Primary CWE: CWE-88
CWE-88 Improper Neutralization of Argument Delimiters in a C…
Vendor / Product: GNU / Inetutils
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: GNU InetUtils Argument Injection Vulnerability
Vendor: GNU
Product: InetUtils
Added to KEV: 2026-01-26
Due date: 2026-02-16
Ransomware: Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA description

GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.

Affected products (1)

Vendor	Product	Platform	Versions
GNU	Inetutils	—	1.9.3 ≤ 2.7

Weakness (CWE)

CWE	Source	Description
CWE-88	cna	CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (8)