CVE-2021-47765: AbsoluteTelnet DOS Vulnerability

CVE-2021-47765 Overview

CVE-2021-47765 is a denial of service vulnerability in Celestial Software AbsoluteTelnet version 11.24. The flaw allows local attackers to crash the application by supplying oversized input to the username and error report fields. Inserting 1000 characters into the username or email address fields causes the application to become unresponsive.

The vulnerability is categorized as an out-of-bounds write [CWE-787], indicating that user-supplied data exceeds the allocated memory region. While the issue does not lead to remote code execution, it disrupts terminal session availability for legitimate users.

Critical Impact
A local attacker can crash AbsoluteTelnet 11.24 by submitting 1000-character strings to the username or email address fields, resulting in application denial of service.

Affected Products

Celestial Software AbsoluteTelnet 11.24
CPE: cpe:2.3:a:celestialsoftware:absolutetelnet:11.24
Component: celestialsoftware:absolutetelnet

Discovery Timeline

2026-01-15 - CVE-2021-47765 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2021-47765

Vulnerability Analysis

The vulnerability resides in how AbsoluteTelnet 11.24 processes input within the username and error report fields. When a user submits a string of 1000 characters into either the username or email address field, the application fails to validate the input length. The result is an out-of-bounds write condition that destabilizes the process and causes it to hang or terminate.

This denial of service requires local access and user interaction. An attacker must trigger the affected input flow within the application, which limits the practical attack surface. The vulnerability does not expose confidentiality or integrity, but availability is impacted because the terminal client becomes unresponsive.

A public proof-of-concept exists at Exploit-DB #50510, demonstrating the crash through field overflow.

Root Cause

The root cause is missing input length validation on the username and email address fields. AbsoluteTelnet allocates a fixed-size buffer for these fields but does not enforce a bounds check before writing the data. Supplying input larger than the allocated buffer triggers an out-of-bounds write [CWE-787], corrupting adjacent memory and crashing the application.

Attack Vector

The attack vector is local with user interaction required. An attacker with local access opens AbsoluteTelnet, navigates to a field that accepts username or error report data, and inserts a 1000-character payload. The application crashes upon processing the oversized string. No elevated privileges are needed to trigger the condition.

The vulnerability cannot be exploited remotely. The attack scope is confined to the AbsoluteTelnet process and does not extend to the host operating system.

Detection Methods for CVE-2021-47765

Indicators of Compromise

Unexpected AbsoluteTelnet.exe process termination or hang events in Windows Application event logs.
Windows Error Reporting (WER) crash dumps referencing AbsoluteTelnet.exe with access violation exceptions.
Repeated launches of AbsoluteTelnet 11.24 followed by abnormal exits on the same endpoint.

Detection Strategies

Monitor for crash events linked to AbsoluteTelnet through Windows Event ID 1000 (Application Error) and Event ID 1001 (Windows Error Reporting).
Inspect process telemetry for AbsoluteTelnet sessions that terminate shortly after launch, especially following user input activity.
Hunt for the presence of vulnerable AbsoluteTelnet 11.24 installations across managed endpoints using software inventory queries.

Monitoring Recommendations

Track installations of AbsoluteTelnet 11.24 via asset management and EDR software inventory features.
Alert on repeated AbsoluteTelnet.exe crashes originating from the same user account within a short time window.
Correlate application crash telemetry with local user logon events to identify potential local abuse patterns.

How to Mitigate CVE-2021-47765

Immediate Actions Required

Identify all endpoints running AbsoluteTelnet 11.24 and prioritize them for upgrade.
Apply any vendor-released version of AbsoluteTelnet newer than 11.24 if available from Celestial Software.
Restrict local interactive access on shared workstations where AbsoluteTelnet is installed.

Patch Information

No specific vendor advisory or patch reference is published in the NVD entry for CVE-2021-47765. Administrators should consult the Celestial Software homepage for the latest AbsoluteTelnet release and upgrade beyond version 11.24.

Workarounds

Avoid entering untrusted or oversized strings into the username and email address fields of AbsoluteTelnet 11.24.
Limit AbsoluteTelnet usage to trusted operators on hardened workstations until an updated version is deployed.
Consider substituting with an alternative terminal client on affected systems where upgrade is not immediately feasible.

bash

# Inventory check for vulnerable AbsoluteTelnet 11.24 installations on Windows
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*AbsoluteTelnet*" -and $_.Version -eq "11.24" }