Why CVE-2026-32746 Grants Root Access to Telnetd [Prime Cyber Insights]

[00:00] Announcer: From Neural Newscast, this is Prime Cyber Insights, [00:03] Announcer: Intelligence for Defenders, Leaders, and Decision Makers. [00:11] Aaron Cole: Welcome to the briefing room. I'm Erin. Today is March 19th and we are tracking a high-risk vulnerability in a legacy protocol that continues to pose a persistent threat to enterprise environments. [00:22] Lauren Mitchell: I'm Lauren. We're breaking down a CVSS 9.8 flaw, Erin. This involves unauthenticated root access to systems before an agent even reaches a login prompt. [00:34] Aaron Cole: Exactly. According to the Hacker News, this is CVE 2026-32746. [00:41] Aaron Cole: Discovered by researchers at the cybersecurity firm Dream and reported on March 11th, [00:46] Aaron Cole: it impacts the GNU INET Utils Telnet daemon across all versions through 2.7. [00:52] Lauren Mitchell: The technical route, as documented by researcher Adele Sol, [00:56] Lauren Mitchell: is an out-of-bounds right within the line mode set local characters sub-option handler. [01:02] Lauren Mitchell: This triggers a buffer overflowed during the handshake. [01:05] Lauren Mitchell: Aaron, for practitioners, the most concerning detail is that this requires no valid credentials. [01:12] Aaron Cole: Precisely, Lauren. [01:13] Aaron Cole: An attacker simply needs to connect to port 23 and send a specially crafted protocol message. [01:19] Aaron Cole: Since Telnet D typically runs with root privileges under INET D or XINET D, [01:24] Aaron Cole: successful exploitation leads to complete system compromise. [01:28] Lauren Mitchell: It's part of a recovery. [01:29] Lauren Mitchell: pattern. This disclosure follows CVE-26-24061, another 9.8-rated flaw in the same implementation [01:39] Lauren Mitchell: from just two months ago. Siza has already confirmed that [01:42] Lauren Mitchell: that the previous vulnerability is being actively exploited in the wild. [01:46] Aaron Cole: That increases the urgency, especially since a patch for this new flaw isn't expected until April 1st. [01:52] Aaron Cole: Lauren, given that two-week window, what is the direct recommendation for teams still running Telnet? [01:57] Lauren Mitchell: The priority is clear. Disable the service if it isn't strictly necessary. [02:02] Lauren Mitchell: If you must use it, block port 23 at the network perimeter and host-based firewalls immediately. [02:08] Lauren Mitchell: You should also consider running Telnet-D without root privileges to limit the potential blast radius. [02:15] Aaron Cole: Isolate, block, or disable. [02:17] Aaron Cole: It is a stark reminder that legacy services require modern defensive postures. [02:22] Aaron Cole: For Prime Cyber Insights, I'm Aaron. [02:24] Lauren Mitchell: And I'm Lauren. [02:25] Lauren Mitchell: For technical details on the dream research, visit pci.neurlnewscast.com. [02:30] Lauren Mitchell: Stay secure. Neural Newscast is AI-assisted, human-reviewed. [02:35] Lauren Mitchell: View our AI Transparency Policy at neuralnewscast.com. [02:38] Announcer: This has been Prime Cyber Insights on Neural Newscast. [02:42] Announcer: Intelligence for defenders, leaders, and decision makers.