GCVE-110-NCSC-2026-33

Advisory PublishedCVSS 9.8/10

Vulnetix · Advisory published January 21, 2026

The GNU Inetutils telnetd version 2.7 is susceptible to a remote authentication bypass due to the manipulation of the USER environment variable to '-f root'.

Download JSON Open in Console

Weaknesses (CWE)

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Risk Scores

CVSS 3.1

9.8/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Threat Intelligence

Snort Rules (1)

1101234 — GNU Inetutils telnetd authentication bypass via USER environment variable (CVE-2026-24061)

Affected Products

Vendor	Product	Versions	Platforms
GNU	vers:unknown/*	—	—

Aliases

CVE-2026-24061

References

advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON