Skip to content
Fencer Vulns
critical 10.0

CVE-2007-0882 in the critical feed json

Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client…

published 2007-02-12 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0878

cvss
10.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
98.1%
EPSS 98.1% chance of exploitation in 30 days, percentile 99.9%
public exploits
4
Metasploit, Exploit-DB

Summary

Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.

Timeline

  1. First public exploit (EDB-3293)
  2. Published

Exploit prediction

98.06% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/solaris/telnet/fuser Sun Solaris Telnet Remote Authentication Bypass Vulnerability metasploit exploit, excellent rank, 2007-02-12
  • EDB-16328 Sun Solaris Telnet - Remote Authentication Bypass (Metasploit) remote, 2010-06-22
  • EDB-9918 Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit) remote, 2007-02-12
  • EDB-3293 SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass remote, 2007-02-11
  • erratasec.blogspot.com http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html referenced PoC, tagged "exploit" by a source, unverified
  • isc.sans.org http://isc.sans.org/diary.html?storyid=2220 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.