Executive brief
GNU InetUtils is a collection of common network programs, including a telnet server used for remote terminal access. A critical vulnerability allows an attacker to bypass the login process and gain full administrative access to the system without a password. This flaw is actively being exploited in the wild and could lead to complete system takeover and data theft.
Technical details
An argument injection vulnerability (CWE-88) exists in the telnetd daemon of GNU InetUtils versions 1.9.3 through 2.7. The vulnerability is rooted in the improper neutralization of argument delimiters when processing the USER environment variable passed during the Telnet protocol negotiation. By providing a specially crafted value such as '-f root', an unauthenticated remote attacker can inject arguments into the underlying login process. This allows the attacker to bypass standard authentication mechanisms and gain a root shell. Patches have been released in the project's source repository, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Affected products
- GNU InetUtils 1.9.3 through 2.7
Timeline
- 2026-01-20: disclosed: Initial disclosure on oss-security mailing list
- 2026-01-26: advisory: NVD publication and CISA KEV addition
- 2026-01-26: exploited: Confirmed active exploitation in the wild per CISA KEV
- 2026-01-30: patched: Patches identified in GNU InetUtils source repository