{"id":"CVE-2007-0882","aliases":["EUVD-2007-0878","GHSA-jpgv-x3r5-pm29"],"status":"published","title":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5...","description":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.98055,"percentile":0.9991,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-88","CWE-94"],"published":"2007-02-12T20:00:00Z","modified":"2026-06-16T22:36:28Z","exploits":[{"source":"exploitdb","id":"EDB-16328","title":"Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)","type":"remote","platform":"solaris","date":"2010-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/16328"},{"source":"exploitdb","id":"EDB-3293","title":"SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass","type":"remote","platform":"solaris","date":"2007-02-11","verified":true,"url":"https://www.exploit-db.com/exploits/3293"},{"source":"exploitdb","id":"EDB-9918","title":"Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit)","type":"remote","platform":"solaris","date":"2007-02-12","verified":true,"url":"https://www.exploit-db.com/exploits/9918"},{"source":"metasploit","id":"exploit/solaris/telnet/fuser","title":"Sun Solaris Telnet Remote Authentication Bypass Vulnerability","type":"exploit","platform":"Solaris,Unix","date":"2007-02-12","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/solaris/telnet/fuser"}],"products":[{"vendor":"oracle","product":"solaris"},{"vendor":"sun","product":"sunos"}],"references":[{"url":"http://www.securityfocus.com/archive/1/459843/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2007/0560","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/32434","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.kb.cert.org/vuls/id/881872","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2202","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Broken Link"]},{"url":"http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/460086/100/100/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/24120","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory"]},{"url":"http://seclists.org/fulldisclosure/2007/Feb/0217.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1017625","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://isc.sans.org/diary.html?storyid=2220","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102802-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","Broken Link"]},{"url":"http://osvdb.org/31881","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/bid/22512","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/459831/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/460103/100/100/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/459980/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-059A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Broken Link","Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/archive/1/459855/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0882"},{"url":"https://github.com/advisories/GHSA-jpgv-x3r5-pm29"}],"sources":{"cve":[{"id":"CVE-2007-0882","description":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.","status":"published","published":"2007-02-12T20:00:00Z","modified":"2024-08-07T12:34:21.133Z","updated_at":"2026-11-02T13:34:15.046008Z"}],"euvd":[{"id":"EUVD-2007-0878","description":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.","status":"published","published":"2007-02-12T20:00:00Z","modified":"2024-08-07T12:34:21Z","updated_at":"2026-11-03T01:38:28.235221Z"}],"ghsa":[{"id":"GHSA-jpgv-x3r5-pm29","title":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5...","description":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.","status":"published","published":"2022-05-01T17:47:50Z","modified":"2025-04-09T03:38:26Z","cwes":["CWE-88","CWE-94"],"updated_at":"2026-11-02T15:00:53.302842Z"}],"nvd":[{"id":"CVE-2007-0882","description":"Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.","status":"published","published":"2007-02-12T20:28:00Z","modified":"2026-06-16T22:36:28.38Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:01:13.10493Z"}]}}