Summary
Kyu Neushwaistein discovered that telnetd in Inetutils incorrectly handled
certain environment variables. A remote attacker could use this issue to
bypass authentication and open a session as an administrator.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | inetutils | 2:2.2-2ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | inetutils | 2:2.5-3ubuntu4.1 |
| Ubuntu · 25.10 | inetutils | 2:2.6-1ubuntu3.1 |
Vulnerabilities 1
-
Critical 9.8
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment…
KEV Jan 26, 2026
References
-
report
https://ubuntu.com/security/CVE-2026-24061