← Vulnerability feed

Vulnerability record · CVE-1999-1090 · published 10 September 1991

CVE-1999-1090: Ncsa telnet vulnerability

Ncsa · Telnet

The default configuration of NCSA Telnet package for Macintosh and PC enables FTP, even though it does not include an "ftp=yes" line, which allows remote attackers to read and modify arbitrary files.

7.5 CVSS 2.0 High EPSS 1.7% · top 24.3%
7.5CVSS 2.0 base score
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
16 Jun 2026Last modified by NVD

Description

The default configuration of NCSA Telnet package for Macintosh and PC enables FTP, even though it does not include an "ftp=yes" line, which allows remote attackers to read and modify arbitrary files.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.cert.org/advisories/CA-1991-15.html PatchThird Party AdvisoryUS Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/1844
http://www.cert.org/advisories/CA-1991-15.html PatchThird Party AdvisoryUS Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/1844

Track CVE-1999-1090 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2005-0468Ncsa telnet vulnerabilityHeap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary …EPSS 27%7.5CVE-2005-0469Ncsa telnet vulnerabilityBuffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to exec…EPSS 8.9%

Source: NIST National Vulnerability Database (record CVE-1999-1090), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.