A high-severity privilege escalation vulnerability exists in GNU inetutils telnetd that allows an unprivileged local user to gain unauthorized elevated access.

The vulnerability stems from an insecure inclusion of functionality from an untrusted control sphere, where telnetd improperly handles the CREDENTIALS_DIRECTORY environment variable. An unprivileged local user can trigger this flaw by creating a login.noauth file, which facilitates privilege escalation by abusing service credentials.

This vulnerability carries a CVSS score of 7.4, indicating a high level of risk to system integrity and confidentiality. Successful exploitation allows an attacker to achieve total system compromise by elevating their privileges beyond their authorized level. This poses a significant threat to internal security, potentially leading to unauthorized data access and full control over the affected host.

Immediate Action: Update GNU inetutils to a patched version beyond 2.7 or apply the upstream fix commit 3953943d8296310485f98963883a798545ab9a6c provided by the vendor.

Proactive Monitoring: Review system logs for the presence of unexpected login.noauth files and monitor for unusual privilege escalation activity or unauthorized process execution.

Compensating Controls: Restrict access to the system to only authorized users, as the attack vector requires local access, and enforce strict file system permissions to prevent the creation of files in sensitive directories.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced via the GitHub repository provided in the enrichment data.

Given the high CVSS severity and the availability of a public proof-of-concept, organizations should prioritize patching GNU inetutils immediately. Failure to remediate this flaw exposes the host to local privilege escalation attacks that could result in a total compromise of system security.