CVE-2015-0014: Windows Telnet service buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10.0 and very high EPSS probability, though the affected platforms are largely legacy.

What it is

The Telnet service in multiple Microsoft Windows versions contains a memory buffer overflow (CWE-119) reachable through crafted network packets. A remote, unauthenticated attacker can trigger it to run arbitrary code on the affected host. Because Telnet is a network-facing service, any exposed system is directly at risk.

Impact

An attacker gains remote code execution with full control of confidentiality, integrity and availability, as reflected by the CVSS 2.0 score of 10.0. Successful exploitation can lead to complete host compromise.

Attack surface

Reached over the network via the Telnet service (AV:N, AC:L, Au:N), requiring no authentication and no user interaction. Any host with the Telnet service enabled and reachable is exposed.

Exploitation

Not listed in CISA KEV and no reference tags indicate a public exploit, but EPSS is very high (0.96893 probability, 99.886th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply Microsoft security bulletin MS15-002 for the affected Windows versions.
• Disable the Telnet service or the Telnet Server feature where it is not required.
• Block inbound TCP port 23 at network boundaries and restrict access to trusted management networks.
• Upgrade or migrate off end-of-life platforms such as Windows Server 2003, Vista and Windows 7.
• Monitor for unusual Telnet traffic and unexpected process creation on Telnet-enabled hosts.

Detection

• Inspect network traffic for malformed or oversized Telnet packets targeting port 23.
• Alert on Telnet service crashes or restarts in Windows event logs.
• Monitor for suspicious child processes spawned by the Telnet service process.
• Audit hosts for the presence of the Telnet Server feature and flag any that are internet-reachable.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.