Buffer overflow vulnerability affecting Telnetd
A critical vulnerability affecting Telnetd would allow an unauthenticated malicious actor to execute arbitrary code or cause a denial of service on affected systems.
Description
Technical context and vulnerability details
Telnetd (Telnet daemon) is a service that allows users to remotely connect to a server or network equipment via the telnet communications protocol. This service is affected by a critical vulnerability labeled CVE-2026-32746 resulting from a lack of data size checking in the add_slc function, used in Telnet protocol management. Exploitation of this vulnerability would allow an unauthenticated attacker to cause a buffer overflow and execute arbitrary code remotely with root privileges. It is classified critical with a severity score of 9.8 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Code Execution;
- Denial of service;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Versions of the Telnet service up to and including 2.7;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Disable the Telnet service if it is not essential, or replace it with a more secure alternative such as SSH;
- Restrict access to Telnet service only to authorized IP addresses;
- Monitor suspicious connection attempts as well as possible service crashes;
- Update the Telnet service to the latest available and stable version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.