Critical Telnetd Vulnerability Enables Remote Code Execution Attacks

A critical buffer overflow vulnerability has been discovered in the GNU InetUtils telnetd daemon.

Tracked as CVE-2026-32746, the flaw carries a maximum CVSS 3.1 score of 9.8 and allows unauthenticated attackers to execute arbitrary code with root privileges.

There is no confirmed active exploitation, and the severity of the flaw demands immediate attention from network defenders.

Discovered by Dream Security Labs, the vulnerability affects all versions of the software up to version 2.7.

Technical Exploitation Details

The vulnerability, classified as CWE-120, originates in the daemon’s code responsible for handling LINEMODE SLC (Set Local Characters) option negotiation.

An attacker can trigger the classic buffer overflow by sending a specially crafted message containing an abnormally high triplet count over TCP port 23 during the initial connection handshake.

Because this code path executes immediately upon connection, well before the daemon presents a login prompt, no credentials or user interaction are required to trigger the exploit.

Since telnetd typically operates with root privileges via inetd or xinetd, a successful overflow grants the attacker complete host compromise.

This enables threat actors to deploy persistent backdoors, exfiltrate sensitive data, or use the compromised host to pivot further into the target network.

While modern IT environments have largely abandoned Telnet in favor of secure alternatives like SSH, the protocol remains deeply embedded in Industrial Control Systems (ICS), operational technology (OT), and government networks.

Many legacy programmable logic controllers (PLCs), SCADA systems, and embedded network devices were manufactured with Telnet as their exclusive remote management interface.

Upgrading this aging infrastructure is often prohibitively expensive or highly disruptive to operations.

As a result, this vulnerability poses a severe physical threat to critical infrastructure, including power grids, water treatment facilities, and manufacturing lines.

In these environments, security modernization cycles are notoriously slow, and legacy equipment is frequently left exposed.

Mitigation and Detection Strategies

Organizations must immediately assess their exposure, as threat actors only need a single network connection to compromise a vulnerable system.

Security teams should disable the telnetd service entirely wherever possible. If the service remains operationally necessary, administrators must block port 23 at the network perimeter, restrict access to strictly trusted IP addresses, and configure the daemon to run without root privileges.

Detecting exploitation requires specific network-level visibility because standard authentication logs will not capture the attack.

Defenders should configure network firewalls to log all new connections to port 23 and capture traffic for forensic review.

Furthermore, organizations should deploy intrusion detection systems, such as Suricata or Snort, to alert on LINEMODE SLC suboptions carrying unusually large payloads exceeding 90 bytes.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.