AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)
Priority MEDIUM 63CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fields. Attackers can trigger the crash by inserting 1000 characters into the username or email address fields, causing the application to become unresponsive.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Celestialsoftware | AbsoluteTelnet | 11.24 | — | No fix listed | CNA |
- AbsoluteTelnet VendorCelestialsoftware Affected 11.24 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:celestialsoftware:absolutetelnet:11.24:*:*:*:*:*:*:* | 11.24 | Vulnerable | Celestialsoftware |
- cpe:2.3:a:celestialsoftware:absolutetelnet:11.24:*:*:*:*:*:*:* Versions 11.24 Vulnerable ·Celestialsoftware
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47765
- 2026-10-03 Alias added: GHSA-chp4-5883-3f2x
References
Exploit 1
Other 1
More Celestialsoftware Absolutetelnet vulnerabilities
- TI-2020-19301 AbsoluteTelnet 11.12 - 'SSH2/username' Denial of Service CVSS 4.0MEDIUM 6.9
- TI-2021-22380 AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC) CVSS 4.0MEDIUM 6.7
- TI-2020-19300 AbsoluteTelnet 11.12 - "license name" Denial of Service CVSS 4.0MEDIUM 6.7
- TI-2020-19299 AbsoluteTelnet 11.12 - "license entry" Denial of Service CVSS 4.0MEDIUM 6.7
Sources
- CVE-2021-47765 · CVE Program
- CVE-2021-47765 · NVD
- FIRST EPSS
- GHSA-chp4-5883-3f2x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences