Well, if security isn't much of a concern (and it looks like it isn't if a webpage is gonna be performing telnet commands...) I would suggest a daemon process running the telnet session and listening on some predefined socket, preferably unix domain. Then, whenever it gets some data on that socket it can do it's thing in the telnet session, preferably with a little data laundering.
Might also be a good idea for the daemon to time out after some long time, and have the client cgi check to see if it's listening on the socket, and if not start the daemon again. That way, there won't always be a telnet session open.

'The fickle fascination of and Everlasting God' - Billy Corgan, The Smashing Pumpkins