CVE-2007-0882: Oracle Solaris

High severity, CVSS 10.0. EPSS: 98% chance of exploitation in the next 30 days.

Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.

Affected products

• Oracle Solaris: version 10 only; version 11 only
• Sun Sunos: version 5.10 only; version 5.11 only

Published 2007-02-12. Last modified 2026-06-16.