Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Telnet allows a remote client to specify environment variables including LD_LIBRARY_PATH, allowing an attacker to bypass the normal system libraries and gain root access.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
18 versions affected across 3 products
| Date | Total | Labels |
|---|
| 2026-02-24 | 2 | Disclosure1PoC1 |
| 2026-02-27 | 1 | Patch1 |
| 2026-03-05 | 1 | Disclosure1 |
a 27 year old regression of CVE-1999-0073 now has a new cve CVE-2026-28372 (this is a new/diff one than from jan) the lesson here is not "jUsT Us# sSh!!!@" 1) ban users 2) ban shells 3) use unikernels https://t.co/hGMbYphRRi
Post summary
The post announces a new CVE and offers mitigations such as banning users and shells or using unikernels, but provides no PoC, exploit code, or technical details about the vulnerability.
Telnetd Vulnerability Report https://www.openwall.com/lists/oss-security/2026/02/24/2 Rediscoveries in InetUtils beyond last month's froot. Incomplete fix of CVE-1999-0073, where the CVE description's example was LD_LIBRARY_PATH, but new LPE PoCs use CREDENTIALS_DIRECTORY and GCONV_PATH. Avoided in Linux NetKit?
Post summary
The post reports that CVE-1999-0073 still has an incomplete fix and that new local privilege escalation PoCs using CREDENTIALS_DIRECTORY and GCONV_PATH have been discovered.
GCONV_PATH Injection in GNU Inetutils telnetd Credit: Discovered by Justin Swartz Reference: https://seclists.org/oss-sec/2026/q1/199 Justin revealed that while CVE-2026-24061 fix addressed the "-f root" authentication bypass, the underlying environment variable sanitization issue remains incomplete. Technical Details: ▪️ telnetd's scrub_env() blacklist misses GCONV_PATH, LANGUAGE, OUTPUT_CHARSET ▪️ When telnetd (running as root) execs /bin/login, AT_SECURE=0 ▪️ glibc doesn't sanitize these dangerous variables ▪️ gettext triggers iconv_open() → loads malicious .so via GCONV_PATH ▪️ Result: Arbitrary code execution as root Timeline: 1999: CVE-1999-0073 disclosed 2026: CVE-2026-24061 patched (USER variable injection) 2026-Feb: Justin Swartz discloses GCONV_PATH vector still exploitable #Security #Infosec #CVE #Linux #Telnetd #PrivilegeEscalation
Post summary
Justin Swartz disclosed that GCONV_PATH injection in GNU Inetutils telnetd remains exploitable, enabling arbitrary root code execution, despite the earlier patch for CVE‑2026‑24061.
Telnet 脆弱性 CVE-2026-24061：27年前の問題の再発による root アクセス https://iototsecnews.jp/2026/02/26/27-years-old-telnet-vulnerability-enables-attackers-to-gain-root-access/ GNU Inetutils に含まれる telnet daemon (telnetd) において、27年前の脆弱性が現代に再燃するという事態が確認されました。この脆弱性 CVE-2026-24061 は、認証を一切必要とせずにリモートからの root 権限取得を、攻撃者に許すというきわめて深刻なものです。問題の核心は、1999年に発見された脆弱性 CVE-1999-0073 と同じく、環境変数の不適切なサニタイズにあります。telnetd がログイン処理のために “/bin/login” を起動する際に、特定の環境変数を無防備に受け入れてしまう設計上の欠陥が残存していました。ご利用のチームは、ご注意ください。 #CVE202624061 #telnet #Vulnerability
Post summary
The article announces that CVE‑2026‑24061, a 27‑year‑old vulnerability in GNU Inetutils telnetd, has resurfaced, permitting unauthenticated remote users to obtain root access via unsanitized environment variables.
20 of 20 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | digital | osf_1 | 1.2 | - | - |
| OS | digital | osf_1 | 1.3 | - | - |
| OS | digital | osf_1 | 2.0 | - | - |
| OS | digital | osf_1 | 3.0 | - | - |
| OS | digital | osf_1 | 3.2 | - | - |
| OS | digital | unix | 3.2g | - | - |
| OS | digital | unix | 4.0 | - | - |
| OS | sgi | irix | 5.0 | - | - |
| OS | sgi | irix | 5.0.1 | - | - |
| OS | sgi | irix | 5.1 | - | - |
| OS | sgi | irix | 5.1.1 | - | - |
| OS | sgi | irix | 5.2 | - | - |
| OS | sgi | irix | 5.3 | - | - |
| OS | sgi | irix | 5.3 | - | - |
| OS | sgi | irix | 6.0 | - | - |
| OS | sgi | irix | 6.0.1 | - | - |
| OS | sgi | irix | 6.0.1 | - | - |
| OS | sgi | irix | 6.1 | - | - |
| OS | sgi | irix | 6.2 | - | - |
| OS | sgi | irix | 6.3 | - | - |