EUVD-2026-101814
GHSA-mrvm-6c78-7qfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed TELSERV network port
-
DeliverySend malformed Telnet data
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionCorrupt process memory
-
ImpactCrash service causing DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the HPE NonStop TELSERV (Telnet server) subsystem listening port on a NonStop system running version T9553L01^BAJ or earlier; the TELSERV service must be enabled and exposed. Exploitation is limited by CVSS High attack complexity (AC:H), meaning the attacker must meet non-trivial conditions (such as specific memory state) to reliably trigger the overflow, and impact is confined to denial of service with no confidentiality or integrity effect. Deployment is further limited because NonStop is a specialized platform typically confined to segmented back-office/payment networks rather than internet-facing exposure. |
| Impact | This is a moderate-severity, limited-impact issue rather than a top-tier priority. The vendor CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9 MEDIUM) describes a network-reachable, unauthenticated flaw whose only impact is availability (A:H) - consistent with the description's 'memory corruption and DoS' and the CWE-121 stack-based buffer overflow classification. Several mitigating signals converge: attack complexity is High (AC:H), meaning reliable exploitation requires conditions outside the attacker's control (e.g. specific memory layout or timing), and there is no confidentiality or integrity impact (C:N/I:N), so this is a crash/denial-of-service bug, not a confirmed code-execution path. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so the current status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation. One caveat worth flagging: stack buffer overflows (CWE-121) can sometimes be escalated from DoS to code execution, but nothing in the vendor data supports that here, so it should be treated as availability-only unless HPE states otherwise. Net: a legitimate patch-worthy issue for NonStop operators, but not an emergency given AC:H, availability-only impact, and absence of exploitation signals. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reach to an exposed HPE NonStop TELSERV (Telnet server) port sends a crafted Telnet protocol sequence that overflows a stack buffer, corrupting memory and crashing the service to deny Telnet access. Because CVSS attack complexity is High, the attacker must satisfy specific conditions for reliable triggering, and no public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Stack-based buffer overflow in HPE NonStop TELSERV (T9553L01^BAJ and earlier) allows unauthenticated remote attackers who can reach the Telnet server subsystem to corrupt memory and crash the service, producing a denial-of-service condition. The vulnerability is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H): exploitation is network-reachable and requires no credentials, but the High attack complexity means the attacker must satisfy non-trivial conditions such as a specific memory state to reliably trigger the overflow, and the impact is confined to availability with no confidentiality or integrity effect. There is no public exploit identified at time of analysis, no CISA KEV listing, and NonStop deployments are typically confined to segmented back-office or payment networks rather than being internet-facing, making this a moderate-severity, limited-impact issue rather than a top-tier priority.
RemediationAI
No vendor-released patch version is identified in the available data; the HPE security note at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US is the authoritative source and should be checked for a fixed NonStop RVU or TELSERV SPR build superseding T9553L01^BAJ before planning upgrades. Until a patched build is confirmed and deployed, the most effective compensating control is network-level: block or tightly restrict TCP access to the TELSERV port so that only explicitly trusted administrative hosts and management subnets can reach it, which directly removes the AV:N exposure path at the cost of losing remote Telnet administration from untrusted segments. If TELSERV is not operationally required, disable the subsystem entirely; the trade-off is loss of Telnet-based operator access, so validate that no scripts, automation, or operators still depend on it. Where the service must remain reachable, place affected NonStop systems behind segmentation/firewall rules (they are typically already in isolated back-office or payment networks) and monitor for abnormal Telnet session terminations or TELSERV process aborts as an indicator of attempted triggering. Note that CVSS AC:H means exploitation is not trivial, so these compensating controls combined with vendor guidance are a reasonable interim posture rather than an emergency workaround.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TELSERV is the Telnet server subsystem of HPE NonStop, the vendor's fault-tolerant Guardian/NonStop OS platform used heavily in payments, financial settlement, and other high-availability back-office workloads. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), meaning crafted input delivered over the TELSERV listening port overflows a fixed-size stack buffer, corrupting adjacent memory. The affected CPE (cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_telserv) is wildcarded for version, while the EUVD record pins the affected build stream at T9553L01^BAJ and earlier. The CVSS vector confirms the network vector with no privileges (PR:N) and no user interaction (UI:N), but the AC:H rating indicates that triggering the corruption reliably depends on conditions the attacker cannot fully control - such as exact memory layout or buffer state - which constrains practical exploitability. Because only the Availability metric is affected (C:N/I:N/A:H), the observed outcome class is service crash or hang rather than code execution or data disclosure, consistent with a classic denial-of-service overflow.
Know when Hpe Nonstop Telserv gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Telnet service is network-reachable (AV:N) and unauthenticated (PR:N), but reliable overflow triggering needs specific conditions (AC:H); impact is crash-only, so C:N/I:N/A:H.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB