duy-31/CVE-2026-24061---telnetd

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (scan_telnet.py) that connects to a Telnet service, negotiates the NEW-ENVIRON option, and sends a USER environment variable value (default '-f root') to test if the target is vulnerable to CVE-2026-24061. It checks the response for 'uid=' to determine if authentication was bypassed, but does not establish an interactive shell or perform post-exploitation actions. The README explicitly states it is a PoC for detecting vulnerable systems.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python script (scan_telnet.py) that implements a PoC scanner for CVE-2026-24061. The script connects to a target, performs Telnet negotiation, sends a USER environment variable (default '-f root') via NEW-ENVIRON, and then sends 'id;exit' to check for a successful authentication bypass. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor indicators were observed. The code is straightforward and its behavior aligns with the stated purpose of detecting the CVE.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareGNU Inetutils telnetd
Attack typesAuthentication BypassArgument Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to detect whether a target is vulnerable to CVE-2026-24061 by sending a crafted USER environment variable and checking the response for a successful command execution indicator ('uid='). It does not attempt to establish an interactive shell, exfiltrate data, or perform any post-exploitation actions. The README describes it as a 'Proof of Concept (PoC) permettant de détecter les systèmes vulnérables' (PoC for detecting vulnerable systems). This is consistent with a scanner, not an exploit.

README.md:9scan_telnet.py:184-192scan_telnet.py:225-230

Requirements

  • Target must be running a vulnerable telnetd service (GNU Inetutils through 2.7) on a reachable port (default 23).README.md:5-7scan_telnet.py:149-151

Observed behavior

  • Connects to a target host and port via TCP, performs Telnet option negotiation (WILL ECHO, WILL SGA), and sends a NEW-ENVIRON SEND request for the USER variable.scan_telnet.py:149-160
  • Responds to the server's NEW-ENVIRON SEND sub-negotiation by sending an IS response containing the USER value (default '-f root').scan_telnet.py:71-80scan_telnet.py:82-84
  • After negotiation, sends the command 'id;exit' and parses the response for a line containing 'uid=' to determine if the target is vulnerable.scan_telnet.py:184-192
  • Exits with code 0 if at least one target is found vulnerable, or 1 if none are vulnerable.scan_telnet.py:225-230
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Telnet Negotiation
NEW-ENVIRON USER variable set to '-f root'The script sends a Telnet NEW-ENVIRON sub-negotiation with USER='-f root' to trigger the authentication bypass described in CVE-2026-24061.scan_telnet.py:64-65scan_telnet.py:158-160
Command Execution
id;exitAfter negotiation, the script sends 'id;exit' to verify if a shell was obtained, which is consistent with a PoC that checks for successful exploitation.scan_telnet.py:185
Output Parsing
Checks for 'uid=' in responseThe script parses the server response for 'uid=' to confirm the identity of the obtained shell, which is a standard method to verify privilege level.scan_telnet.py:189-192
Review boundaries

What the analysis did not establish

  • Only two of four repository files were provided as text; the other two files (file count reported 4, text files with content 2) are omitted, so the full repository content is not available for analysis.
  • The analysis is based solely on static code review; the code was not executed, and its behavior against a live target is not verified.
  • Two files (totaling 1117 bytes) were omitted from the text evidence and flagged as metadata-only; their content was not reviewed. The inventory indicates 4 total files, but only README.md and scan_telnet.py were included as text.
  • The review is limited to static analysis of the provided source code; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1