Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-10188

68
FAUCET Score

CVE-2020-10188 is a critical buffer overflow vulnerability in netkit telnetd, affecting versions through 0.17, and impacting products from vendors like Arista, Debian, and Oracle. This flaw allows remote attackers to execute arbitrary code due to improper handling of short writes or urgent data within the netclear and nextitem functions. With a CVSS score of 9.8, it represents a severe risk, as it can be exploited remotely without authentication or user interaction, leading to complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 0.17CPE matchmatch criteria
cpe:2.3:a:netkit_telnet_project:netkit_telnet:*:*:*:*:*:*:*:*
30CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
31CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
32CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
74.51%
Probability of exploitation in next 30 days
EPSS Percentile
99.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.7451 is in the 98th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

github_advisorypatch availablevia nvd_reference
View patch
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: telnet-1:0.17-49.el6_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: krb5-appl-0:1.0.1-10.el6_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: telnet-1:0.17-65.el7_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118)Fixed in: telnet-1:0.17-65.el7_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Telco Extended Update SupportFixed in: telnet-1:0.17-65.el7_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.6 Update Services for SAP SolutionsFixed in: telnet-1:0.17-65.el7_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Advanced Update SupportFixed in: telnet-1:0.17-65.el7_7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Telco Extended Update SupportFixed in: telnet-1:0.17-65.el7_7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.7 Update Services for SAP SolutionsFixed in: telnet-1:0.17-65.el7_7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: telnet-1:0.17-73.el8_1.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.0 Update Services for SAP SolutionsFixed in: telnet-1:0.17-73.el8_0.1
View patch

Vendor Advisories (1)

redhatCVE-2020-10188Important

telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code

Feb 28, 2020

References

openwall.com / lists/oss-security/2026/01/20/8
appgateresearch.blogspot.com / 2020/02/bravestarr-fedora-31-netkit-telnetd_28.html
Third Party Advisory
github.com / krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c
PatchThird Party Advisory
lists.debian.org / debian-lts-announce/2020/05/msg00012.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2020/08/msg00038.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/7FMTRRQTYKWZD2GMXX3GLZV46OLPCLVK
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/HLU6FL24BSQQEB2SJC26NLJ2MANQDA7M
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/K3VJ6V2Z3JRNJOBVHSOPMAC76PSSKG6A
tools.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-telnetd-EFJrEzPx
Third Party Advisory
arista.com / en/support/advisories-notices/security-advisories/10702-security-advisory-48
Third Party Advisory
oracle.com / security-alerts/cpuApr2021.html
PatchThird Party Advisory