Telnetd Authentication Bypass via Login Flag Injection (CVE-2026-24061)

nomit vyas@xoxo

•updated Mar 8, 2026•12•0•482

Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.