Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
CVE-2011-4862
HIGHCVSS v2 · 10.010.0—Weaponized
EchelonGraph scoreLOW confidence
This CVE was only ever scored under CVSS v2.0. NVD CVSS v2.0 base 10.0 — v2 rates that HIGH (v2 bands: LOW 0.0–3.9 / MEDIUM 4.0–6.9 / HIGH 7.0–10.0; v2 has no CRITICAL band). Vector AV:N/AC:L/Au:N/C:C/I:C/A:C. CVSS v2 is an older, coarser metric than v3.1/v4.0 (no Scope, no User Interaction, no Attack Requirements), so it is not directly comparable to a v3 or v4 score. NVD has never re-scored this record under v3. EPSS predicts 95.1% exploitation probability in the next 30 days, which is reflected in EG Risk but does not lift the v2 base. Confidence: LOW.
Sources: epss, nvd_v2
10.0EG
EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.
- High exploitation likelihood — EPSS 95%
- Public exploit code is available (Metasploit, Exploit-DB (verified), epss top5pct, epss high, public exploit)
CISA-KEV: Not listedEPSS PROB: 95%CVSS v2: 10.0Exploit: Metasploit · Exploit-DB (verified) · epss top5pct · epss high · public exploitExposed: 0
A fix is available — apply it.
- CVSS v2.0 (legacy)
- 10.0HIGHNVD never assigned a CVSS v3 rating to this CVE
- EG Score
- 10.0(low)
- EG Risk
- 88(Track)EG Risk 88/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity100% × 45%Exploitation95% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 95%
- EPSS %ILE
- 100%
- KEV
- Not listed
Published
December 25, 2011
Last Modified
April 29, 2026
References (84)
- secteam@freebsdhttp://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html
- secteam@freebsdhttp://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
- secteam@freebsdhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html
- secteam@freebsdhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html
- secteam@freebsdhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html
- secteam@freebsdhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html
- secteam@freebsdhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html
- secteam@freebsdhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
- secteam@freebsdhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
Patch Availability(4)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| redhat | krb5-0:1.6.1-55.el5_6.3 | 2011-12-28 | redhat |
| redhat | krb5-appl-0:1.0.1-2.el6_1.3 | 2011-12-28 | redhat |
| redhat | krb5-0:1.6.1-63.el5_7 | 2011-12-27 | redhat |
| redhat | krb5-appl-0:1.0.1-7.el6_2 | 2011-12-27 | redhat |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Affected Packages
(18 across 6 ecosystems)
Debian:11(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| heimdal | — | 1.5.dfsg.1-1 | — |
| inetutils | — | 2:1.8-6 | — |
| krb5 | — | 1.8+dfsg~aa+r23527-1 | — |
Debian:12(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| heimdal | — | 1.5.dfsg.1-1 | — |
| inetutils | — | 2:1.8-6 | — |
| krb5 | — | 1.8+dfsg~aa+r23527-1 | — |
Debian:13(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| heimdal | — | 1.5.dfsg.1-1 | — |
| inetutils | — | 2:1.8-6 | — |
| krb5 | — | 1.8+dfsg~aa+r23527-1 | — |
Debian:14(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| heimdal | — | 1.5.dfsg.1-1 | — |
| inetutils | — | 2:1.8-6 | — |
| krb5 | — | 1.8+dfsg~aa+r23527-1 | — |
Debian:5.0(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| heimdal | 1.2.dfsg.1-2.1, 1.2.dfsg.1-2.1+hurd.1 | 1.2.dfsg.1-2.1+lenny1 | — |
| inetutils | 2:1.5.dfsg.1-9 | 2:1.5.dfsg.1-9+lenny1 | — |
| krb5 | 1.6.dfsg.4~beta1-5 ... 1.6.dfsg.4~beta1-5lenny6 (6 versions) | 1.6.dfsg.4~beta1-5lenny7 | — |
Debian:6.0(3)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| heimdal | 1.4.0~git20100726.dfsg.1-1, 1.4.0~git20100726.dfsg.1-2 | 1.4.0~git20100726.dfsg.1-2+squeeze1 | — |
| inetutils | 2:1.6-3.1 | 2:1.6-3.1+squeeze1 | — |
| krb5-appl | 1:1.0.1-1, 1:1.0.1-1.1 | 1:1.0.1-1.2 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
All Vendor Advisories
(4)
Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.
Data Freshness Timeline
(refreshed 1× in last 7d / 10× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-08-19 16:59 UTCEPSS rescore
- 2026-08-09 13:42 UTCEPSS rescore
- 2026-08-08 07:49 UTCOSV refresh
- 2026-07-26 13:44 UTCEG score recompute▲ 10.00
- 2026-07-23 01:06 UTCVendor advisory
- 2026-07-23 01:06 UTCGHSA enrichment
- 2026-07-23 01:06 UTCEG score recompute▼ 9.00
- 2026-07-23 00:09 UTCEG score recompute
- 2026-07-22 21:54 UTCOSV refresh
- 2026-07-22 21:48 UTCEG score recompute
- 2026-07-22 14:04 UTCEPSS rescore
- 2026-07-22 14:04 UTCEPSS rescore
- 2026-07-21 15:21 UTCEPSS rescore
- 2026-07-18 10:00 UTCEPSS rescore
- 2026-07-05 16:59 UTCOSV refresh
- 2026-06-27 03:05 UTCEPSS rescore
- 2026-06-27 03:05 UTCEPSS rescore
- 2026-06-23 21:30 UTCEPSS rescore
- 2026-06-22 14:22 UTCEPSS rescore
- 2026-06-22 14:22 UTCEPSS rescore
- 2026-06-21 01:56 UTCEPSS rescore
- 2026-06-21 01:56 UTCEPSS rescore
- 2026-06-17 04:14 UTCOSV refresh
- 2026-06-15 17:44 UTCEPSS rescore
- 2026-06-13 22:57 UTCEPSS rescore
Show 19 moreShow fewer
- 2026-06-12 23:08 UTCEPSS rescore
- 2026-06-06 13:45 UTCEPSS rescore
- 2026-06-06 13:45 UTCEPSS rescore
- 2026-06-04 13:09 UTCEPSS rescore
- 2026-05-29 13:41 UTCEPSS rescore
- 2026-05-29 05:55 UTCEG score recompute
- 2026-05-29 05:55 UTCVendor advisory
- 2026-05-29 05:55 UTCGHSA enrichment
- 2026-05-26 13:41 UTCEPSS rescore
- 2026-05-26 13:41 UTCEPSS rescore
- 2026-05-24 16:43 UTCEPSS rescore
- 2026-05-22 21:15 UTCEPSS rescore
- 2026-05-22 21:15 UTCEPSS rescore
- 2026-05-22 21:15 UTCEPSS rescore
- 2026-05-20 22:37 UTCEPSS rescore
- 2026-05-20 22:37 UTCEPSS rescore
- 2026-05-20 22:37 UTCEPSS rescore
- 2026-05-18 21:29 UTCEPSS rescore
- 2026-05-18 21:29 UTCEPSS rescore
Publicly available exploits
(7 references)Working exploit code is in the public domain (3 Metasploit modules) (1 GitHub PoC) (3 Exploit-DB entries). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
- GitHub PoChdbreaker/GO-CVE-2011-4862First seen Feb 2, 2017
Go Exploit for CVE-2011-4862
Open source ↗ - Exploit-DBEDB-18369✓ verifiedFirst seen Jan 14, 2012
FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)
Open source ↗ - Exploit-DBEDB-18368✓ verifiedFirst seen Jan 14, 2012
Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)
Open source ↗ - Exploit-DBEDB-18280✓ verifiedFirst seen Dec 26, 2011
TelnetD encrypt_keyid - Function Pointer Overwrite
Open source ↗ - Metasploitexploit/freebsd/telnet/telnet_encrypt_keyid✓ verifiedFirst seen Dec 23, 2011
FreeBSD Telnet Service Encryption Key ID Buffer Overflow
Open source ↗ - Metasploitexploit/linux/telnet/telnet_encrypt_keyid✓ verifiedFirst seen Dec 23, 2011
Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow
Open source ↗ - Metasploitauxiliary/scanner/telnet/telnet_encrypt_overflow✓ verifiedFirst seen Jan 1, 2011
Telnet Service Encryption Key ID Overflow Detection
Open source ↗
Related CVEs(same vendor + same CWE)
Same vendor
10 shownredhat
- CVE-2001-0825EG 10.0HIGH
- CVE-2001-1009EG 10.0EPSS p93HIGH
- CVE-2001-0554EG 10.0EPSS p98HIGH
- CVE-2001-1162EG 10.0EPSS p96HIGH
- CVE-2001-0414EG 10.0EPSS p100HIGH
- CVE-2001-0191EG 10.0EPSS p92HIGH
- CVE-2001-0301EG 10.0EPSS p91HIGH
- CVE-2001-0197EG 10.0EPSS p96HIGH
- CVE-2001-0233EG 10.0EPSS p96HIGH
- CVE-2001-0010EG 10.0EPSS p98HIGH
Same CWE
10 shownCWE-120
- CVE-2010-10016EG 10.0CRITICAL
- CVE-2012-10035EG 10.0CRITICAL
- CVE-2008-3496EG 10.0HIGH
- CVE-2007-1770EG 10.0EPSS p97HIGH
- CVE-2002-1337EG 10.0EPSS p99HIGH
- CVE-2001-0554EG 10.0EPSS p98HIGH
- CVE-2001-0191EG 10.0EPSS p92HIGH
- CVE-1999-1237EG 10.0EPSS p94HIGH
- CVE-1999-0385EG 10.0EPSS p97HIGH
- CVE-1999-0046EG 10.0EPSS p99HIGH
Frequently asked(4)
What is CVE-2011-4862?
CVE-2011-4862 is a high vulnerability published on December 25, 2011. Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as…
When was CVE-2011-4862 disclosed?
CVE-2011-4862 was first published in the National Vulnerability Database on December 25, 2011, with the most recent update on April 29, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2011-4862 actively exploited?
CVE-2011-4862 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 95% probability of exploitation in the next 30 days, which ranks it in the top 0.1% of all scored CVEs.
How do I remediate CVE-2011-4862?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2011-4862, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2011-4862
Is Your Infrastructure Affected by CVE-2011-4862?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.