PoC Released for GNU Telnetd RCE, 800K+ Still Exposed

A working proof-of-concept exploit has been made public for CVE-2026-24061, a critical remote code execution vulnerability affecting GNU Inetutils telnetd.

Security researchers warn that the impact could be widespread, as more than 800,000 telnet services are still directly reachable from the internet. With exploit code now available, the barrier to attack is much lower, increasing the likelihood of large-scale scanning and exploitation.

Why this vulnerability is a serious threat

The flaw allows remote attackers to execute commands on vulnerable systems without authentication. In other words, an attacker does not need valid credentials to gain control.

The root cause is improper input validation in the telnet daemon, which can be abused to bypass security checks and run arbitrary commands on the host.

Telnet itself is a legacy remote access protocol that sends all traffic, including usernames and passwords, in plain text. This has long made it a weak point in network security. When combined with a remote code execution vulnerability, exposed telnet services become extremely high-risk. Attackers can use them not only for initial access, but also for deploying malware, stealing credentials, moving laterally inside networks, or adding compromised systems to botnets.

The release of public exploit code changes the risk level significantly. Threat actors no longer need to develop their own tools, making automated attacks more likely. Internet-wide scans continue to show hundreds of thousands of systems with telnet open on common ports, proving that outdated services are still running in production environments.

Recommended actions for organizations

• Identify all systems exposing Telnet, including port 23 and alternate ports such as 2323
• Immediately disable telnet services on internet-facing systems
• Migrate remote administration to secure alternatives like SSH
• Use firewalls and network segmentation to restrict access to legacy systems that cannot yet be removed
• Monitor logs and network traffic for unusual command execution or unauthorized access attempts
• Prioritize patching and remediation as part of urgent risk reduction efforts

Because the exploit is public and the exposed attack surface is so large, this vulnerability presents a real risk of mass exploitation. Organizations that continue to operate telnet services should act quickly to reduce exposure and prevent potential system compromise.