CVE-2021-47764
📋 TL;DR
AbsoluteTelnet 11.24 contains a local denial-of-service vulnerability where attackers can crash the application by pasting specially crafted 1000-character payloads into DialUp connection and license name fields. This affects users running AbsoluteTelnet 11.24 on Windows systems where local access is available.
💻 Affected Systems
- AbsoluteTelnet
📦 What is this software?
Absolutetelnet by Celestialsoftware
⚠️ Risk & Real-World Impact
Worst Case
Persistent application crashes disrupting legitimate users' terminal sessions and workflow, potentially causing data loss in unsaved sessions.
Likely Case
Temporary disruption of telnet/SSH sessions requiring application restart, causing minor productivity impact.
If Mitigated
No impact if application is patched or workarounds are implemented to restrict local access.
🎯 Exploit Status
Exploit requires local access to paste payload into specific fields. Proof of concept available in exploit database.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.25 or later
Vendor Advisory: https://www.celestialsoftware.net/
Restart Required: Yes
Instructions:
1. Download latest version from vendor website. 2. Run installer. 3. Restart system or at least the AbsoluteTelnet application.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit which users can run AbsoluteTelnet or access the system where it's installed.
Input Validation Script
windowsImplement script to monitor and block excessive input in vulnerable fields.
🧯 If You Can't Patch
- Restrict application to trusted users only via Windows permissions.
- Monitor for application crashes and investigate source systems.
🔍 How to Verify
Check if Vulnerable:
Check AbsoluteTelnet version in Help > About. If version is 11.24, system is vulnerable.Check Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Verify version is 11.25 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crash logs in Windows Event Viewer
- Unexpected AbsoluteTelnet process termination
Network Indicators:
- None - local exploit only
SIEM Query:
EventID=1000 AND ProcessName="AbsoluteTelnet.exe" AND ExceptionCode=0xC0000005