GNU InetUtils telnetd Authentication Bypass via Crafted `USER` Environment Variable

A critical authentication-bypass vulnerability was disclosed in GNU InetUtils telnetd that allows a remote, unauthenticated attacker to obtain access as root (or any known user) by supplying a crafted USER environment variable. The issue arises because telnetd passes the remote-supplied USER value to /usr/bin/login without sanitization; an attacker can set USER to -f root, leveraging the login(1) -f option to bypass normal authentication checks and immediately gain privileged access. Reported by Simon Josefsson, the flaw appears to have been introduced in 2015 and affects GNU InetUtils versions 1.9.3 and later (with reporting indicating impact through at least 2.7); at the time of reporting, no CVE had been assigned.

Mitigations emphasized include disabling Telnet (preferred due to the protocol’s inherent insecurity), restricting access to trusted clients via network controls, and applying upstream fixes where available. Operationally, defenders are advised to rapidly identify exposed services—particularly Linux systems running Telnet—because exploitation requires only network reachability to telnetd and results in full system compromise; one approach suggested for discovery is querying asset inventories for Linux hosts offering Telnet (e.g., os:Linux protocol:telnet) and then validating which implementation is in use before prioritizing remediation.