Beyond its protocol weaknesses, the Telnet server code itself has a long history of memory-corruption bugs, and because telnetd often runs as root and predates modern exploit mitigations (especially on legacy Unix and embedded builds), these yield remote code execution with high privilege. The classic classes are stack buffer overflows in option and environment handling (the telrcv/encryption-option code paths) and format-string flaws, several reachable pre-authentication. An exposed old telnetd is therefore not just a weak login but a direct RCE target once fingerprinted.
# fingerprint the telnetd implementation/version (banner, option negotiation)
nc <target> 23; nmap -p23 -sV <target>
# match the build to the applicable advisory: stack overflow vs format string
Subtopics#
- Stack overflow: buffer overflows in option/environment handling.
- Format string: format-string flaws in telnetd.