[yoyoma2]

Is busybox affected by CVE-2026-24061? In the comments someone is asking about busybox.

This video demonstrates how to login with telnet as root without a password prompt. I tried it against my dd-wrt and still got prompted for the password.

[yoyoma2]

BusyBox telnetd is not vulnerable to CVE-2026-24061 because it does not construct the login command using user-controlled placeholders. Instead, it invokes the login process using fixed arguments, which prevents argument injection and authentication bypass in this context. source

Thank you for your attention to this matter.

[kernel-panic69]

Moved to Generic (development). I couldn't find anything that pointed towards this vulnerability, just didn't respond until now. Source code for telnetd applet in busybox is not entirely the same nor does it use the same constructs as inetutils' telnetd as you noted.