CVE-2003-0516: cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes, which may...

Security readout for executives and security teams

CVE-2003-0516 affects old mgetty versions. A remote party may be able to place shell metacharacters in caller ID or caller name data and cause arbitrary command execution. Business risk is high where legacy dial-up, fax, or modem systems still run mgetty 1.1.28 or earlier. Evidence is sparse and no active exploitation is indicated by KEV. Likely limited to legacy Unix/Linux systems using mgetty 1.1.28 or earlier with caller ID/name handling enabled. Internet exposure may be low, but exposure can exist through telephone/modem interfaces rather than normal IP services. Treat as high priority only if legacy mgetty systems remain in service. For most modern environments, urgency is likely low after inventory confirms absence. The main task is finding and retiring or updating forgotten dial-up infrastructure. Mitigation focus: Inventory systems for mgetty installations and versions.; Prioritize systems connected to modems, fax lines, or dial-in services.; Upgrade away from mgetty 1.1.28 or earlier where supported..

Prepared

Jul 12, 2026, 03:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.