WaratekVRT Sign in

CVE-2020-10188 netkit telnet

Affected softwarenetkit telnet
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessCWE-120
Published6 Mar 2020
Updated17 Jun 2026

Description

utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.

Exploitation status

Forecast only (74% 30-day chance)

No exploit has been reported in the sources we check. EPSS puts this CVE in the top 0.50% of all scored CVEs. That is a model's forecast, not a report of exploitation.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 74% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle Communications / Mediation server (Telnet) (10.4.0.2)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Mediation server (Telnet) 10.4.0.2 10.4.0.2

Products and versions

6 products, 359 version entries
SourceVendorProductSchemeAffected versions
nvd arista eos generic ≤ 4.20.15 · ≥ 4.21.0 and ≤ 4.21.10 · ≥ 4.22 and ≤ 4.22.4 · ≥ 4.23 and ≤ 4.23.3 · 4.24.0f
nvd debian debian linux generic 8.0 · 9.0
nvd fedoraproject fedora generic 30 · 31 · 32
nvd juniper junos generic 12.3 · 12.3:r1 · 12.3:r2 · 12.3:r3 · 12.3:r4 · 12.3:r5 · 12.3:r6 · 12.3:r7 · 12.3:r8 · 12.3:r9 · 12.3:r10 · 12.3:r10-s1 · 12.3:r10-s2 · 12.3:r11 · 12.3:r12 · 12.3r12 · 12.3:r12-s1 · 12.3:r12-s3 · 12.3:r12-s4 · 12.3:r12-s6 · 12.3:r12-s8 · 12.3:r12-s10 · 12.3:r12-s11 · 12.3:r12-s12 · 12.3:r12-s13 · 12.3:r12-s14 · 12.3:r12-s15 · 12.3:r13 · 12.3x48 · 12.3x48:d10 · 12.3x48:d15 · 12.3x48:d20 · 12.3x48:d25 · 12.3x48:d30 · 12.3x48:d35 · 12.3x48:d40 · 12.3x48:d45 · 12.3x48:d50 · 12.3x48:d51 · 12.3x48:d55 · 12.3x48:d60 · 12.3x48:d65 · 12.3x48:d66 · 12.3x48:d70 · 12.3x48:d75 · 12.3x48:d80 · 12.3x48:d85 · 12.3x48:d90 · 12.3x48:d95 · 12.3x48:d100 · 12.3x50 · 12.3x50:d20 · 12.3x50:d30 · 12.3x50:d35 · 12.3x50:d40 · 12.3x50:d45 · 15.1 · 15.1:f · 15.1:r · 15.1:a1 · 15.1:f1 · 15.1:r1 · 15.1:f2 · 15.1:r2 · 15.1:f2-s1 · 15.1:f2-s2 · 15.1:f2-s3 · 15.1:f2-s4 · 15.1:f3 · 15.1:r3 · 15.1:f4 · 15.1:r4 · 15.1:r4-s7 · 15.1:r4-s8 · 15.1:r4-s9 · 15.1:f5 · 15.1:r5 · 15.1:r5-s1 · 15.1:r5-s3 · 15.1:r5-s5 · 15.1:r5-s6 · 15.1:f5-s7 · 15.1:f6 · 15.1:r6 · 15.1:f6-s1 · 15.1:r6-s1 · 15.1:f6-s2 · 15.1:r6-s2 · 15.1:f6-s3 · 15.1:r6-s3 · 15.1:f6-s4 · 15.1:r6-s4 · 15.1:f6-s5 · 15.1:f6-s6 · 15.1:r6-s6 · 15.1:f6-s7 · 15.1:f6-s8 · 15.1:f6-s9 · 15.1:f6-s10 · 15.1:f6-s12 · 15.1:f7 · 15.1:r7 · 15.1:r7-s1 · 15.1:r7-s2 · 15.1:r7-s3 · 15.1:r7-s4 · 15.1:r7-s5 · 15.1:r7-s6 · 15.1x49 · 15.1x49:d10 · 15.1x49:d15 · 15.1x49:d20 · 15.1x49:d25 · 15.1x49:d30 · 15.1x49-d30 · 15.1x49:d35 · 15.1x49:d40 · 15.1x49:d45 · 15.1x49:d50 · 15.1x49:d55 · 15.1x49:d60 · 15.1x49-d60 · 15.1x49:d65 · 15.1x49:d70 · 15.1x49:d75 · 15.1x49:d80 · 15.1x49:d90 · 15.1x49:d100 · 15.1x49:d110 · 15.1x49:d120 · 15.1x49:d130 · 15.1x49:d131 · 15.1x49:d140 · 15.1x49-d140 · 15.1x49:d150 · 15.1x49-d150 · 15.1x49:d160 · 15.1x49-d160 · 15.1x49:d170 · 15.1x49:d180 · 15.1x49:d190 · 15.1x49:d200 · 15.1x49:d210 · 16.1 · 16.1:r · 16.1:r1 · 16.1:r2 · 16.1:r3 · 16.1:r3-s8 · 16.1:r3-s10 · 16.1:r3-s11 · 16.1:r4 · 16.1:r4-s2 · 16.1:r4-s3 · 16.1:r4-s4 · 16.1:r4-s6 · 16.1:r4-s8 · 16.1:r4-s9 · 16.1:r4-s12 · 16.1:r5 · 16.1:r5-s4 · 16.1:r6 · 16.1:r6-s1 · 16.1:r6-s3 · 16.1:r6-s4 · 16.1:r6-s6 · 16.1:r7 · 16.1:r7-s2 · 16.1:r7-s3 · 16.1:r7-s4 · 16.1:r7-s5 · 16.1:r7-s6 · 16.1:r7-s7 · 17.2 · 17.2:r1 · 17.2:r1-s1 · 17.2:r1-s2 · 17.2:r1-s3 · 17.2:r1-s4 · 17.2:r1-s5 · 17.2:r1-s6 · 17.2:r1-s7 · 17.2:r1-s8 · 17.2:r2 · 17.2:r2-s4 · 17.2:r2-s6 · 17.2:r2-s7 · 17.2:r2-s11 · 17.2:r3 · 17.2:r3-s1 · 17.2:r3-s2 · 17.2:r3-s3 · 17.2x75 · 17.3 · 17.3:r1 · 17.3:r1-s1 · 17.3:r1-s4 · 17.3:r2 · 17.3:r2-s1 · 17.3:r2-s2 · 17.3:r2-s3 · 17.3:r2-s4 · 17.3:r2-s5 · 17.3:r3 · 17.3:r3-s1 · 17.3:r3-s2 · 17.3:r3-s3 · 17.3:r3-s4 · 17.3:r3-s5 · 17.3:r3-s6 · 17.3:r3-s7 · 17.3:r3-s8 · 17.4 · 17.4:r1 · 17.4:r1-s1 · 17.4:r1-s2 · 17.4:r1-s3 · 17.4:r1-s4 · 17.4:r1-s5 · 17.4:r1-s6 · 17.4:r1-s7 · 17.4:r2 · 17.4:r2-s1 · 17.4:r2-s2 · 17.4:r2-s3 · 17.4:r2-s4 · 17.4:r2-s5 · 17.4:r2-s6 · 17.4:r2-s7 · 17.4:r2-s8 · 17.4:r2-s9 · 17.4:r2-s10 · 17.4:r3 · 17.4:r3-s1 · 18.1 · 18.1:r1 · 18.1:r2 · 18.1:r2-s1 · 18.1:r2-s2 · 18.1:r2-s4 · 18.1:r3 · 18.1:r3-s1 · 18.1:r3-s2 · 18.1:r3-s3 · 18.1:r3-s4 · 18.1:r3-s5 · 18.1:r3-s6 · 18.1:r3-s7 · 18.1:r3-s8 · 18.1:r3-s9 · 18.2 · 18.2:r · 18.2:r1 · 18.2:r1-s2 · 18.2:r1-s3 · 18.2:r1-s4 · 18.2:r1-s5 · 18.2:r2 · 18.2:r2-s1 · 18.2:r2-s2 · 18.2:r2-s3 · 18.2:r2-s4 · 18.2:r2-s5 · 18.2:r2-s6 · 18.2:r2-s7 · 18.2:r2-s8 · 18.2:r3 · 18.2:r3-s1 · 18.2:r3-s2 · 18.2:r3-s3 · 18.2:r3-s4 · 18.2x75 · 18.2x75-d10 · 18.2x75:d12 · 18.2x75:d20 · 18.2x75:d30 · 18.2x75-d30 · 18.2x75:d40 · 18.2x75:d50 · 18.2x75:d51 · 18.2x75:d60 · 18.2x75:d411 · 18.3 · 18.3:r1 · 18.3:r1-s1 · 18.3:r1-s2 · 18.3:r1-s3 · 18.3:r1-s4 · 18.3:r1-s5 · 18.3:r1-s6 · 18.3:r2 · 18.3:r2-s1 · 18.3:r2-s2 · 18.3:r2-s3 · 18.3:r3 · 18.3:r3-s1 · 18.3:r3-s2 · 18.4 · 18.4:r1 · 18.4:r1-s1 · 18.4:r1-s2 · 18.4:r1-s3 · 18.4:r1-s4 · 18.4:r1-s5 · 18.4:r1-s6 · 18.4:r1-s7 · 18.4:r2 · 18.4:r2-s1 · 18.4:r2-s2 · 18.4:r2-s3 · 18.4:r2-s4 · 18.4:r3 · 18.4:r3-s1 · 18.4:r3-s2 · 18.4:r3-s3 · 19.1 · 19.1:r1 · 19.1:r1-s1 · 19.1:r1-s2 · 19.1:r1-s3 · 19.1:r1-s4 · 19.1:r1-s5 · 19.1:r1-s6 · 19.1:r2 · 19.1:r2-s1 · 19.1:r3 · 19.1:r3-s1 · 19.2 · 19.2:r1 · 19.2:r1-s1 · 19.2:r1-s2 · 19.2:r1-s3 · 19.2:r1-s4 · 19.3 · 19.3:r1 · 19.3:r1-s1 · 19.3:r2 · 19.3:r2-s1 · 19.3:r2-s2 · 19.4 · 19.4:r1 · 19.4:r1-s1 · 19.4:r1-s2 · 19.4:r2 · 20.1 · 20.1:r1 · 20.1:r1-s1
nvd netkit telnet project netkit telnet generic ≤ 0.17
nvd oracle communications performance intelligence center generic 10.4.0.2

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** MEDIATION SERVER (TELNET), TELNET **Products:** TELNET-SERVER, ORACLE COMMUNICATIONS PERFORMANCE INTELLIGENCE CENTER SOFTWARE, ORACLE COMMUNICATIONS

References

URLTags
https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html Third Party Advisory
https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216 Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00012.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00038.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7FMTRRQTYKWZD2GMXX3GLZV46OLPCLVK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLU6FL24BSQQEB2SJC26NLJ2MANQDA7M/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3VJ6V2Z3JRNJOBVHSOPMAC76PSSKG6A/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-telnetd-EFJrEzPx Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/10702-security-advisory-48 Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch, Third Party Advisory

Timeline
Published2020-03-06By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.