800,000 Servers at Risk Amid Active Attacks

Hackers are on the hunt for open Telnet ports in servers after discovering that a version of the legacy client-server application protocol is vulnerable to an authentication bypass vulnerability. More than 800,000 servers could be actively targeted in the wild.

See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions

The risk posed to operational technology environments in particular is acute, given the prevalence of legacy and embedded equipment that may sport the flaw. Also posing risks are legacy and shadow internet of things devices, since Telnet was often enabled in such gear by default.

The flaw is “an absolute gift for nation-state threat actors looking for persistence on OT systems,” said Ian Thornton-Trump, CISO of Inversion6.

The flaw, tracked as CVE-2026-24061, came to light publicly on Jan. 20 thanks to a security alert and patches from programmers who maintain the widely used telnetd server software. A coder warned that it has a critical flaw that attackers could exploit to gain root-level access to a system. The telnetd software is part of InetUtils, which is a free set of network utilities for the Unix-like operating system GNU – built into many Linux distributions.

If attackers send a specially crafted user variable – specifically, the string -f root – as a user environment variable to the server, “the client will be automatically logged in as root bypassing normal authentication processes,” said developer Simon Josefsson.

The InetUtils team released telnetd version 2.8, which blocks exploitation of the flaw, also publishing stand-alone patches.

All prior versions of telnetd from 1.9.3, released in May 2015, are vulnerable. In light of the flaw and its severity, the InetUtils team recommended that organizations “do not run a telnetd server at all,” or else use a firewall to “restrict network access to the Telnet port to trusted clients” and “apply the patch or upgrade to a newer release which incorporates the patch,” when or if that happens.

As a workaround, they said telnetd could be disabled or a user could “make the InetUtils telnetd use a custom login(1) tool that does not permit use of the '-f' parameter.”

Security experts have urged organizations to immediate audit their infrastructure for all devices – including shadow IoT – that have the flaw, and immediately remediate them.

“This is exactly setting the stage for the ‘Cyber Pearl Harbor’ scenario that has been on cyberthreat researchers’ mind. This is, in my mind, a once-in-a-decade type of vulnerability and should be addressed at the highest priority,” Thornton-Trump told Information Security Media Group.

He said the risk is especially acute “in developing nations that may have a great deal of legacy tech, unsupported by manufacturers.”

Software in Widespread Use

The U.S. Cybersecurity and Infrastructure Security Agency on Monday added the flaw to its catalog of known exploited vulnerabilities, setting a Feb. 16 deadline for federal civilian agencies to patch or mitigate the flaw.

Adding complexity to the race to patch is that telnetd fixes “must be incorporated into the packages of the various distributions before they can be implemented,” warned the Canadian Center for Cybersecurity.

“Until then, the patches can only be implemented by modifying them in the code (in telnetd/utility.c) and then compiling them independently,” it said. Sectors likely at elevated risk from this vulnerability include manufacturing, as well as logistics and the maritime industry, due in part to the wide use of embedded systems that run a version of Linux that won’t have been updated post-deployment, said a Monday security alert from the Global Technology Industry Association.

The association flagged legacy networking equipment used by telecommunications providers worldwide, plus devices aimed at small and medium-size organizations that may have Telnet built in for remote troubleshooting purposes, as being at high risk.

The organization recommended that organizations actively scan their own networks for signs of “to identify legacy” or “shadow” IoT devices on the network that may be running vulnerable versions of GNU InetUtils without the administrator’s knowledge.”

Multiple Debian and Ubuntu releases appear to be among the vulnerable software.

The Shadowserver Foundation, a nonprofit security organization that combats malware, botnets and fraud, said it isn’t able to “explicitly” scan for instances of GNU InetUtils telnetd that have the CVE-2026-24061 flaw due to a “lack of ability to check in a safe way.”

But the watchdog said that about 800,000 Telnet instances remain exposed to the internet, mostly in Asia and South America. On a country level, it counted about 130,000 exposed endpoints in China and 119,000 in Brazil, followed by 50,000 in the United States, 41,000 in Japan, 30,000 in Mexico and 27,000 in India.

Experts advise never using Telnet, since the legacy protocol transmits usernames and passwords in cleartext. If it must be used, administrators should ensure it’s completely locked down and never internet-exposed.

“This is a good example of how vulnerabilities can still be found in legacy systems/protocols. Make sure you’re not running it,” said cybercrime expert Alan Woodward, a visiting professor of computer science at the University of Surrey, in a post to social platform X.

Exploit Attempts Spike

Less than 24 hours after InetUtils released its telnetd security bulletin, cybersecurity firm GreyNoise said that its honeypots began recording both opportunistic and targeted exploit attempts.

GreyNoise reported seeing direct exploitation attempts though telnet sessions, at least one malware distribution server likely pushing botnet command-and-control software or crypto miners, as well as “dual-purpose infrastructure,” referring to red-teaming and other tools that can be used for both legitimate and malicious purposes. The firm warned that successful attempts can give attackers persistent remote access, even if their telnet shell gets terminated.

In many cases, attackers appear to be attempting to unleash Python-based malware after gaining access to devices. “This is a ‘zero-effort’ exploit that grants immediate root access, making it highly attractive for botnet operators and state-sponsored actors,” GTIA said.

One honeypot configured to look for signs of CVE-2026-24601 was compromised in less than 60 minutes, said Tyler Hudak, director of incident response at Inversion6, in a post to LinkedIn. “Attackers logged in as root and immediately executed commands, installed backdoors and began scanning for more targets,” he said.

“Organizations risk-modeling this vulnerability may review more than just their on-premises equipment. This isn’t just Linux servers – IOT devices are affected as well.”

“Your organization may be safe, but what about the devices your employees have at home?” Hudak said.

Exploits for the flaw are the subject of discussions on pro-Russian hacking forums, “so we can definitely expect an increase in the scanning for available servers,” said Milivoj Rajić, head of threat intelligence at cybersecurity firm DynaRisk.

Some of these discussions are focused on “terminal commands for carrying out attacks” but also detail more automated tools being developed “that give even less expert people the ability to carry out attacks,” he said.