CVE-2001-0554 describes a critical buffer overflow vulnerability in the BSD-based telnetd daemon, affecting numerous operating systems including Debian, FreeBSD, OpenBSD, and Solaris. This flaw allows unauthenticated remote attackers to execute arbitrary commands by sending a malformed AYT (Are You There) option, which the telrcv function fails to handle securely. With a CVSS score of 10.0, it represents a high-severity risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit code is publicly available, as evidenced by an ExploitDB entry, though there is no indication of widespread active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0CPE matchmatch criteria | cpe:2.3:a:mit:kerberos:1.0:*:*:*:*:*:*:* | ||
1.1CPE matchmatch criteria | cpe:2.3:a:mit:kerberos_5:1.1:*:*:*:*:*:*:* | ||
1.1.1CPE matchmatch criteria | cpe:2.3:a:mit:kerberos_5:1.1.1:*:*:*:*:*:*:* | ||
1.2CPE matchmatch criteria | cpe:2.3:a:mit:kerberos_5:1.2:*:*:*:*:*:*:* | ||
1.2.1CPE matchmatch criteria | cpe:2.3:a:mit:kerberos_5:1.2.1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.