Telnet Vulnerability - Critical Flaw Enables Remote Code Execution

The Flaw

A newly discovered vulnerability in Telnet, tracked as CVE-2026-32746, has a staggering CVSS score of 9.8, marking it as critical. This flaw resides in the GNU inetutils telnetd, a widely used implementation of the Telnet protocol. The vulnerability allows attackers to execute arbitrary code as root before any authentication occurs, which means they can take full control of affected systems almost instantly.

The root cause of this vulnerability is a buffer overflow that occurs in the telnetd LINEMODE Set Local Characters (SLC) handler. During Telnet protocol negotiation, the system fails to check the boundaries of a buffer, allowing malicious actors to exploit it by sending specially crafted messages. This exploitation can lead to complete system compromise, especially since many deployments run telnetd with root privileges.

What's at Risk

The affected systems include legacy infrastructure, networking equipment, and embedded systems that still utilize the Telnet protocol. This vulnerability is particularly concerning as it affects devices listening on TCP port 23. Any system that has the vulnerable telnetd service enabled is at risk, including popular Linux distributions like Debian, Ubuntu, RHEL, and SUSE.

Dream Security's researchers have emphasized that a single network connection to port 23 is sufficient to trigger the vulnerability. No authentication, user interaction, or special network position is required for exploitation, making it a significant threat to organizations still relying on Telnet.

Patch Status

After reporting the vulnerability to the maintainers on March 11, a patch was prepared the following day. The maintainers plan to release it by April 1. Until then, organizations must take immediate action to protect their systems from potential exploitation.

Dream Security has recommended several workarounds, including migrating to more secure alternatives like SSH and disabling telnetd. Running telnetd without root privileges is another suggested measure. If these options are not viable, blocking port 23 at the network perimeter and restricting its use to trusted hosts is crucial.

Immediate Actions

Organizations must act swiftly to mitigate the risks associated with this vulnerability. Here are some immediate steps to consider:

• Disable Telnet: If possible, switch to SSH or disable telnetd entirely.
• Run as Non-Root: If telnetd must remain enabled, ensure it does not run with root privileges.
• Network Controls: Block access to TCP port 23 from untrusted networks.
• Monitor Systems: Keep an eye on systems for any unauthorized access attempts.

This vulnerability highlights the ongoing risks associated with legacy protocols like Telnet. As organizations continue to modernize their infrastructure, addressing such vulnerabilities is essential to maintaining security.