800k Telnet Devices Open to Root-Login Bypass (CVE-2026-24061)
TL;DR Summary
Shadowserver has identified about 800,000 IPs fingerprinted for Telnet activity, highlighting widespread exposure to the root-login bypass in GNU InetUtils telnetd (CVE-2026-24061) affecting 1.9.3–2.7 and patched in 2.8; attackers can bypass authentication by sending USER=-f root via Telnet IAC. GreyNoise detected limited exploits starting Jan 21 from 18 IPs across 60 sessions, with 83% targeting root; attackers also attempted Python malware deployment but failed due to missing binaries. Most exposed devices are in Asia and the Americas; admins should disable vulnerable telnetd or block port 23 until patching.
- Nearly 800,000 Telnet servers exposed to remote attacks BleepingComputer
- Critical GNU InetUtils telnetd Flaw Lets Attackers Bypass Login and Gain Root Access The Hacker News
- Ancient telnet bug happily hands out root to attackers theregister.com
- Hackers exploit critical telnetd auth bypass flaw to get root BleepingComputer
- Organizations Warned of Exploited Linux Vulnerabilities SecurityWeek
Reading Insights
Total Reads
1
Unique Readers
11
Time Saved
3 min
vs 4 min read
Condensed
88%
709 → 88 words
Want the full story? Read the original article
Read on BleepingComputer