Because attacker-supplied flow data is used in public flows, the bug leads to unauthenticated remote code execution.
The flaw in a legacy Telnet implementation enables pre-auth remote code execution, exposing affected systems to full compromise.