tag
NEW-ENVIRON
CVE-2026-28372
binary
HIGH 7.4
GNU inetutils telnetd Local Privilege Escalation via NEW-ENVIRON Injection — CVE-2026-28372
GNU inetutils telnetd forwards client-controlled environment variables — negotiated via the Telnet NEW-ENVIRON option — to the login(1) process it spawns without adequately sanitizing them. On systems where the installed login (from util-linux) supports a…
Patched
2026-07-05
CVE-2026-24061
network
CRITICAL 9.8
KEV
EPSS 98%
GNU Inetutils telnetd Unauthenticated Root RCE via NEW-ENVIRON (CVE-2026-24061)
CVE-2026-24061 is a critical authentication bypass in GNU Inetutils telnetd that grants an unauthenticated network attacker an immediate root shell. The NEW-ENVIRON Telnet option handler passes the USER environment variable unsanitised to /bin/login. Setting…
Patched
2026-06-30