CVE-2020-36995

Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service

Medium4.6Public exploitEPSS 0.41%

Published: 29 Jan 2026
Updated: 12 May 2026
Reserved: 27 Jan 2026
Assigned by: VulnCheck

Description

Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration input. Attackers can overwrite the 'User' field with 350 bytes of repeated characters to trigger an application crash and prevent normal functionality.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-48728 (opens in a new tab)exploit

Timeline

2026
27 Jan 2026
27 Jan 2026
ID reserved
By VulnCheck
29 Jan 20262 days later
29 Jan 2026· 2 days later
Published
12 May 20263 months later
12 May 2026· 3 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-36995, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium4.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	Medium4.6	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.41% · top 65% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.

Weakness

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs

Affected products

telnet-lite · Mocha Telnet Lite for iOS
- affected 4.2

References (3)

ExploitDB-48728 (opens in a new tab)exploit
Official App Store Page for Mocha Telnet Lite (opens in a new tab)product
VulnCheck Advisory: Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-36995](https://trackcve.app/badge/CVE-2020-36995.svg)](https://trackcve.app/cve/CVE-2020-36995)

Record last updated 12 May 2026, 20:46 UTC.