{"id":"CVE-2026-24061","revision":"6e570db2c5ab47f088be5d5c389e5f4d","records":[{"revision":"6e570db2c5ab47f088be5d5c389e5f4d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-24061","aliases":[],"title":"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.","description":"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.","state":0,"publishedAt":"2026-01-21T06:42:17.134+00:00","modifiedAt":"2026-09-29T19:43:14.235+00:00","affected":[{"ecosystem":"Vendor product","name":"Inetutils","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"product\": \"Inetutils\",\n                    \"vendor\": \"GNU\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"2.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"1.9.3\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://www.openwall.com/lists/oss-security/2026/01/20/2","https://www.openwall.com/lists/oss-security/2026/01/20/8","https://www.gnu.org/software/inetutils/","https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html","https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b","https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc","https://www.vicarius.io/vsociety/posts/cve-2026-24061-detection-script-remote-authentication-bypass-in-gnu-inetutils-package","https://www.vicarius.io/vsociety/posts/cve-2026-24061-mitigation-script-remote-authentication-bypass-in-gnu-inetutils-package","https://redteam.ae/blog/cve-2026-24061-inetutils-telnetd-root-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24061","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-24061","identifiers":["CVE-2026-24061"]},"retained":false,"historicalAffected":[]}],"coverage":[]}