PT-2026-25391 · Gnu · Telnet

Justin Swartz · Published 2026-01-01 · Updated 2026-05-05 · CVE-2026-32772

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions telnet versions through 2.7

Description telnet in GNU inetutils allows servers to read arbitrary environment variables from clients via the NEW ENVIRON SEND USERVAR functionality. The issue involves the ability of servers to access client environment variables, potentially exposing sensitive information.

Recommendations versions prior to 2.8

Exploit

Fix

Weakness Enumeration

CWE-669

Related Identifiers

BDU:2026-04683

CVE-2026-32772

Affected Products

Telnet

References · 13

• 🔥 https://openwall.com/lists/oss-security/2026/03/13/1 · Exploit
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0512SE18MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32772 · Security Note
• https://ubuntu.com/security/CVE-2026-32772 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32772 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32772 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32772 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32772 · Security Note
• https://bdu.fstec.ru/vul/2026-04683 · Security Note
• https://t.me/CVEtracker/47378 · Telegram Post
• https://ftp.gnu.org/gnu/inetutils · Note
• https://twitter.com/CVEnew/status/2032605834262249699 · Twitter Post
• https://t.me/cveNotify/162216 · Telegram Post