CVE-2009-0641

no score yetEPSS 9.3%

sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library.

EPSS: 9.3% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWEs: CWE-16, CWE-264
Published: 2009-02-20
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

freebsd:freebsd

References

http://lists.grok.org.uk/pipermail/full-disclosure/2009-February/067954.html
http://security.freebsd.org/advisories/FreeBSD-SA-09:05.telnetd.asc
http://www.securityfocus.com/bid/33777
https://exchange.xforce.ibmcloud.com/vulnerabilities/48780
https://www.exploit-db.com/exploits/8055

Check your stack JSON