#weekendmeme #suggestion_box

Recently came across an interesting CVE with CVSS score of 9.8: CVE-2026-24061 Unauthenticated Root Access in telnetd. The issue dates back to version 1.9.3, released in May 2015.

Root Cause:

The vulnerability stems from a commit that added a %U placeholder to the login command template. This placeholder is replaced with the USER environment variable, which clients can set through Telnet’s NEW_ENVIRON option during connection negotiation. The issue is that telnetd performs no sanitization or validation of this value before inserting it into the command arguments.

An attacker can exploit this by setting USER to "-f root". When telnetd constructs the login command, it becomes:

/usr/bin/login -h [hostname] “-f root”

The -f flag tells login to skip authentication entirely and immediately grant a shell to the specified user. This results in instant root access without providing any credentials.

See more.

#random_PoK #InfoSec #suggestion_box

#dev #qa

#architecture #cluster

#projectmanagement #agile #scrum #waterfall

#dev #based #pr

#ai #llm #deepseek

#qa #mobile #frontend

#network #suggestion_box

#ai #assembly #vibecoding #ffmpeg

#ai #vibecoding

#fridaymeme #deploy #prod

After Friday #deploy to #prod

#fridaymeme

#weekendmeme #claude #ai