CVE-2020-37164 Overview
CVE-2020-37164 is a denial of service vulnerability in Celestial Software AbsoluteTelnet version 11.12. The flaw resides in the license entry field, which fails to validate input length before processing. A local attacker can paste a 2,500-character payload into the license name field to crash the application. The issue is classified under [CWE-120] Buffer Copy without Checking Size of Input (Classic Buffer Overflow).
Critical Impact
Local user interaction with an oversized license name string crashes the AbsoluteTelnet application, disrupting active terminal sessions and connected workflows.
Affected Products
- Celestial Software AbsoluteTelnet 11.12
- Vendor: celestialsoftware
- Product CPE: cpe:2.3:a:celestialsoftware:absolutetelnet:*
Discovery Timeline
- 2026-02-07 - CVE-2020-37164 published to NVD
- 2026-02-19 - Last updated in NVD database
Technical Details for CVE-2020-37164
Vulnerability Analysis
The vulnerability exists in the license entry handler of AbsoluteTelnet 11.12. The application accepts user-supplied input for the license name but does not enforce a maximum length boundary before copying the string into a fixed-size buffer. When an attacker pastes a 2,500-character payload into the license field, the oversized input triggers a buffer condition that crashes the process. The result is a denial of service against the local terminal application. The EPSS data shows a low predicted exploitation probability, consistent with the local attack vector and required user interaction.
Root Cause
The root cause is missing input length validation on the license name field, mapped to [CWE-120]. The application copies attacker-controlled input into memory without checking that the destination buffer is large enough. AbsoluteTelnet does not truncate or sanitize the license string before processing it. The oversized write corrupts adjacent memory and forces the application to terminate.
Attack Vector
Exploitation requires local access to the workstation running AbsoluteTelnet and user interaction with the license dialog. An attacker generates a 2,500-character string and pastes it into the license entry field. Submission of the field crashes the application immediately. The flaw does not yield code execution based on current public analysis. The proof of concept is documented in Exploit-DB #48005 and the VulnCheck Advisory on AbsoluteTelnet.
Detection Methods for CVE-2020-37164
Indicators of Compromise
- Unexpected termination of AbsoluteTelnet.exe shortly after user interaction with the license dialog
- Windows Error Reporting (WER) or Application Event Log entries citing an access violation in AbsoluteTelnet 11.12
- Crash dumps containing long repeating ASCII strings near the faulting instruction pointer
Detection Strategies
- Monitor endpoint telemetry for repeated AbsoluteTelnet.exe process crashes on hosts running version 11.12
- Inventory installed software and flag systems running the affected version for prioritized patching
- Review user activity logs around the time of process crashes to identify whether interaction with the license field preceded the failure
Monitoring Recommendations
- Forward Windows Application and Reliability logs to a centralized SIEM for crash correlation
- Alert on faulting module entries referencing AbsoluteTelnet.exe to identify denial of service attempts
- Track software inventory changes to detect installations of vulnerable AbsoluteTelnet builds across the fleet
How to Mitigate CVE-2020-37164
Immediate Actions Required
- Identify all endpoints running AbsoluteTelnet 11.12 and restrict access to trusted users
- Instruct users to avoid pasting untrusted content into the license entry dialog
- Apply application allowlisting policies to control which users can launch AbsoluteTelnet on shared workstations
Patch Information
No vendor advisory URL is published in the NVD record. Administrators should consult the Celestial Software Homepage for the latest AbsoluteTelnet release and upgrade away from version 11.12. Confirm version numbers after deployment to verify remediation.
Workarounds
- Limit interactive logon rights on systems where AbsoluteTelnet is installed to reduce local exploitation exposure
- Educate users that pasting unknown strings into license activation fields can crash the application
- Where feasible, migrate to an alternative terminal client until a patched build is confirmed by the vendor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
