telnetd in GNU Inetutils versions up to 2.7 allows an attacker to bypass authentication by setting the USER environment variable to a value that includes the string -f root. This flaw lets a remote client gain privileged access without supplying valid credentials, effectively giving them root privileges on the host. The weakness is a classic example of an authentication bypass flaw categorized as CWE-88, where the system fails to enforce proper authentication checks, compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects the GNU Inetutils package, specifically telnetd in versions 2.7 and earlier. By default, Debian 11 (Debian Linux 11), which includes Inetutils 2.7, is also impacted. Any installation running an unpatched telnetd daemon exposed to a network is at risk.

The issue scores a CVSS base of 9.8, indicating a critical level of risk, and has an EPSS score of 87 %, reflecting a very high probability that attackers will target this flaw. It is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that it is actively exploited in the wild. The likely attack vector is a remote telnet session; a malicious actor can configure the USER environment variable prior to or during the connection, provoking telnetd to treat the client as the root user and granting unrestricted system access.