CVE-2021-47764: AbsoluteTelnet DoS Vulnerability

CVE-2021-47764 Overview

CVE-2021-47764 is a denial of service vulnerability in Celestial Software AbsoluteTelnet version 11.24. The flaw allows a local attacker to crash the application by submitting an oversized input string into specific user interface fields. The affected fields are the DialUp connection name and the license name input. An attacker generates a 1000-character payload and pastes it into these fields to force application termination. The vulnerability is classified under [CWE-787] Out-of-Bounds Write, indicating improper bounds handling when processing the user-supplied string.

Critical Impact
Local attackers can crash AbsoluteTelnet 11.24 by pasting a 1000-character payload into the DialUp or license name fields, disrupting terminal session availability.

Affected Products

Celestial Software AbsoluteTelnet 11.24
Windows installations bundling AbsoluteTelnet 11.24
Any deployment of the vulnerable build identified in CPE celestialsoftware:absolutetelnet:11.24

Discovery Timeline

2026-01-15 - CVE-2021-47764 published to the National Vulnerability Database (NVD)
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2021-47764

Vulnerability Analysis

The vulnerability resides in how AbsoluteTelnet 11.24 handles user-supplied strings within configuration input fields. Specifically, the DialUp connection field and the license name field accept input without enforcing a safe upper-bound length. When a string of approximately 1000 characters is pasted into either field, the application writes past the allocated buffer boundary and terminates. The condition is mapped to [CWE-787] Out-of-Bounds Write, which results in an availability impact rather than memory corruption suitable for code execution. Exploitation requires local access and user interaction with the affected dialog, limiting practical attack scenarios to scripted or shared-workstation contexts.

Root Cause

The root cause is missing input length validation on text controls used for DialUp connection and license name entry. The application does not truncate or reject input that exceeds the size of the internal fixed-length buffer. When the oversized string is processed, an out-of-bounds write occurs, causing the AbsoluteTelnet process to crash.

Attack Vector

An attacker with local access to a workstation running AbsoluteTelnet 11.24 opens the DialUp configuration or license entry dialog. The attacker pastes a 1000-character payload into the vulnerable field and triggers form processing. The application crashes and any active terminal sessions are lost. No authentication is required, but user interaction with the affected dialog must occur. Refer to Exploit-DB #50511 for the published proof of concept.

Detection Methods for CVE-2021-47764

Indicators of Compromise

Unexpected termination of AbsoluteTelnet.exe recorded in Windows Application event logs with faulting module references.
Windows Error Reporting (WER) crash dumps for AbsoluteTelnet showing access violations during dialog input processing.
Repeated short-lived AbsoluteTelnet process instances correlated with user activity on DialUp or license configuration screens.

Detection Strategies

Monitor for Event ID 1000 (Application Error) entries naming AbsoluteTelnet.exe as the faulting application.
Inspect endpoint telemetry for crash events on hosts running the vulnerable 11.24 build identified by the CPE cpe:2.3:a:celestialsoftware:absolutetelnet:11.24.
Correlate clipboard paste events into AbsoluteTelnet windows with subsequent process termination to identify exploitation attempts.

Monitoring Recommendations

Track installed software inventory to flag any host still running AbsoluteTelnet 11.24.
Alert on repeated AbsoluteTelnet crashes on the same endpoint within a short time window.
Forward Windows Application and WER logs to a centralized log platform for correlation across the fleet.

How to Mitigate CVE-2021-47764

Immediate Actions Required

Identify all endpoints running AbsoluteTelnet 11.24 using software inventory data.
Restrict access to shared workstations where AbsoluteTelnet is installed to trusted users only.
Disable or restrict the DialUp connection and license entry workflows on systems that do not require them.

Patch Information

No vendor advisory URL is listed in the NVD record for CVE-2021-47764. Administrators should consult the Celestial Software website for the latest AbsoluteTelnet release and upgrade affected hosts to a version newer than 11.24 once available. Verify update integrity against vendor-published checksums before deployment.

Workarounds

Avoid pasting untrusted content into AbsoluteTelnet configuration dialogs, particularly DialUp and license fields.
Apply application allowlisting to prevent unauthorized users from launching AbsoluteTelnet on shared systems.
Replace AbsoluteTelnet 11.24 with an alternative terminal client until a patched build is verified.

bash

# Configuration example: Identify vulnerable AbsoluteTelnet installations on Windows
Get-WmiObject -Class Win32_Product | \
  Where-Object { $_.Name -like "*AbsoluteTelnet*" -and $_.Version -eq "11.24" } | \
  Select-Object Name, Version, InstallLocation