CVE-2021-47765
📋 TL;DR
AbsoluteTelnet 11.24 contains a local denial of service vulnerability where attackers can crash the application by inserting 1000+ characters into username or email fields. This affects users running the vulnerable version of AbsoluteTelnet on their systems. The vulnerability requires local access to the target system.
💻 Affected Systems
- AbsoluteTelnet
📦 What is this software?
Absolutetelnet by Celestialsoftware
⚠️ Risk & Real-World Impact
Worst Case
Application becomes completely unresponsive and crashes, potentially causing loss of unsaved work and disrupting terminal sessions.
Likely Case
Local users with access to the application can cause it to crash, disrupting legitimate users' terminal sessions.
If Mitigated
Limited to application crash only - no privilege escalation, data theft, or remote exploitation possible.
🎯 Exploit Status
Exploit requires local access to the application. Proof of concept available on Exploit-DB (ID 50510).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.25 or later
Vendor Advisory: https://www.celestialsoftware.net/
Restart Required: Yes
Instructions:
1. Download latest version from Celestial Software website. 2. Install the update. 3. Restart AbsoluteTelnet application.
🔧 Temporary Workarounds
Input Validation via Group Policy
windowsImplement input length restrictions for username and email fields
Application Whitelisting
windowsRestrict which users can run AbsoluteTelnet to prevent unauthorized access
🧯 If You Can't Patch
- Restrict local access to AbsoluteTelnet to trusted users only
- Implement monitoring for application crashes and investigate repeated incidents
🔍 How to Verify
Check if Vulnerable:
Check AbsoluteTelnet version in Help > About menu. If version is 11.24, system is vulnerable.Check Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Verify version shows 11.25 or later in Help > About menu after update.📡 Detection & Monitoring
Log Indicators:
- Application crash logs
- Windows Event Logs showing AbsoluteTelnet process termination
Network Indicators:
- No network indicators - local vulnerability only
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="AbsoluteTelnet.exe"