[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <a0bae914813cc517@orthanc.ca>
Date: Thu, 26 Feb 2026 11:20:45 -0800
From: "Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>
To: oss-security@...ts.openwall.com, Albert Veli <albert.veli@...il.com>
Subject: Re: Telnetd Vulnerability Report
Albert Veli writes:
> I agree to this, but I can add that telnet remains widely used for login
> in OT (Operational Technology) environments, including sites running
> critical infrastructure. While operators often justify this by relying
> on network isolation, this reasoning breaks down the moment the air gap
> is bridged.
True, but I suspect that many of those implementations are running
in firmware that has been long abandonded. So if you are going to
craft a CVE on this, how do you address those legacy systems? Or
should a CVE even be written for them, if there is no hope of ever
updating the code?
We have to accept that there are cases where the problem simply
cannot be fixed. At best we can identify them, and warn users of
that gear that they have an unrepairable vulnerability that must
be addresses independtly. It boils down to "identify and warn."
It's important to not get caught up on unsolvable problems. An
awful lot of time gets burned up trying to solve things that can't
be.
--lyndon
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
