The Telnet client for Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX allows remote attackers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-033
No PoCs found on GitHub currently.