CVE-2020-37166: AbsoluteTelnet DOS Vulnerability

CVE-2020-37166 Overview

CVE-2020-37166 is a denial of service vulnerability in Celestial Software AbsoluteTelnet version 11.12. The flaw exists in the SSH2 username input field, which fails to properly validate input length. A local attacker can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires local access and no privileges or user interaction beyond launching the affected client. The issue affects availability only, with no impact on confidentiality or integrity of system data.

Critical Impact
Local attackers can crash the AbsoluteTelnet client by submitting an oversized username string to the SSH2 connection dialog, disrupting active terminal sessions.

Affected Products

Celestial Software AbsoluteTelnet 11.12
SSH2 client component handling username input
Windows installations of AbsoluteTelnet relying on the vulnerable build

Discovery Timeline

2026-02-07 - CVE-2020-37166 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2020-37166

Vulnerability Analysis

The vulnerability resides in the SSH2 username input handler of AbsoluteTelnet 11.12. The application accepts user-supplied input for the SSH2 username field without enforcing an appropriate length boundary. When an attacker supplies approximately 1000 bytes of data, the application fails to handle the oversized buffer and terminates. This produces a denial of service condition against the local client process. Published references include the Exploit-DB #48010 entry and the VulnCheck Advisory.

Root Cause

The root cause is improper input validation on a fixed-size buffer used to store the SSH2 username, consistent with [CWE-120]. The application does not check the length of supplied input before copying it into the destination buffer. This classic unbounded copy pattern results in memory corruption sufficient to crash the process, though publicly available analysis indicates the impact is limited to denial of service rather than code execution.

Attack Vector

Exploitation requires local access to a system running AbsoluteTelnet 11.12. An attacker with the ability to interact with the client supplies a username string of roughly 1000 bytes through the SSH2 connection dialog. The oversized input triggers the crash and terminates the active terminal session. Because the attack vector is local and impacts only availability, the practical risk is limited to disrupting user workflows on shared workstations or kiosk-style deployments. Refer to the Exploit-DB #48010 entry for the published proof-of-concept describing the input pattern.

No verified exploitation code is reproduced here. See the public references for technical reproduction steps.

Detection Methods for CVE-2020-37166

Indicators of Compromise

Unexpected termination of AbsoluteTelnet.exe shortly after a user opens an SSH2 connection dialog
Windows Application event log entries showing application crashes for the AbsoluteTelnet process
Presence of AbsoluteTelnet version 11.12 binaries on endpoints based on file version metadata

Detection Strategies

Inventory endpoints for installations of AbsoluteTelnet 11.12 using software asset management or endpoint telemetry
Monitor for repeated abnormal exits of the AbsoluteTelnet process, which may indicate exploitation attempts or instability
Correlate process crash events with local user sessions to identify suspicious patterns of repeated client failures

Monitoring Recommendations

Collect Windows Error Reporting and Application crash events from workstations running terminal client software
Alert on multiple AbsoluteTelnet termination events from the same user within a short time window
Track usage of legacy SSH client versions through endpoint detection and response telemetry

How to Mitigate CVE-2020-37166

Immediate Actions Required

Identify all endpoints running AbsoluteTelnet 11.12 and prioritize them for remediation
Upgrade to a newer version of AbsoluteTelnet from the Celestial Software homepage once a fixed release is confirmed
Restrict local interactive access to systems where AbsoluteTelnet is installed to trusted users only

Patch Information

No vendor advisory URL is listed in the enriched CVE data. Administrators should consult the Celestial Software homepage for the latest AbsoluteTelnet release and verify that the SSH2 username input handling has been corrected. Until a confirmed fixed version is identified, treat all AbsoluteTelnet 11.12 installations as vulnerable.

Workarounds

Replace AbsoluteTelnet 11.12 with an alternative SSH client that is actively maintained
Apply application allowlisting to prevent execution of the vulnerable AbsoluteTelnet 11.12 binary
Limit local user privileges and restrict who can launch terminal client software on shared systems
Educate users to avoid pasting untrusted content into SSH connection dialogs

bash

# Example: Identify AbsoluteTelnet 11.12 installations on Windows endpoints
Get-ChildItem -Path 'C:\Program Files*\*AbsoluteTelnet*' -Recurse -Filter 'AbsoluteTelnet.exe' |
  ForEach-Object { $_.VersionInfo | Select-Object FileName, FileVersion }