Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-129126 (GCVE-0-2026-129126)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding

Summary

C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/37e5…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 0 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:41.944Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/37e54720779237897bc6887efac42fe138817897"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L461"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-heap-buffer-overflow-via-putsrv-packet-decoding"
        }
      ],
      "title": "C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129126",
    "datePublished": "2026-11-13T16:23:41.944Z",
    "dateReserved": "2026-11-13T16:01:01.879Z",
    "dateUpdated": "2026-11-13T16:23:41.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129125 (GCVE-0-2026-129125)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY

Summary

C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/85ef…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-6.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 6.0.192 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:42.610Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/85ef1da670cee132ea2d8e4eb759bab310ff73c9"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L2544"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-command-execution-via-remote-query"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129125",
    "datePublished": "2026-11-13T16:23:42.610Z",
    "dateReserved": "2026-11-13T16:01:01.509Z",
    "dateUpdated": "2026-11-13T16:23:42.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129124 (GCVE-0-2026-129124)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE

Summary

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/29c4…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 0 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:43.321Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L1423"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space"
        }
      ],
      "title": "C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129124",
    "datePublished": "2026-11-13T16:23:43.321Z",
    "dateReserved": "2026-11-13T16:01:01.143Z",
    "dateUpdated": "2026-11-13T16:23:43.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129123 (GCVE-0-2026-129123)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 21:11

Title

C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies

Summary

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:11 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/39ab…	patch
https://github.com/OpenKermit/ckermit/commit/bec2…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129123",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:11:22.241547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:11:40.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:43.967Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L11161"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129123",
    "datePublished": "2026-11-13T16:23:43.967Z",
    "dateReserved": "2026-11-13T16:01:00.787Z",
    "dateUpdated": "2026-11-13T21:11:40.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129122 (GCVE-0-2026-129122)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation

Summary

C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/39ab…	patch
https://github.com/OpenKermit/ckermit/commit/42cf…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-6.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 6.0.192 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:44.625Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/42cf6decb926f56d606a76262791aaf071955d25"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckctel.c#L5622"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-buffer-overflow-via-telnet-new-environ-negotiation"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129122",
    "datePublished": "2026-11-13T16:23:44.625Z",
    "dateReserved": "2026-11-13T16:01:00.441Z",
    "dateUpdated": "2026-11-13T16:23:44.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129121 (GCVE-0-2026-129121)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE

Summary

C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/9b18…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:45.325Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/9b1809b2ce2bcec08b7285deb1b7f0bcbef6a052"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L7668"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-path-traversal-via-ftp-mget-recursive"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129121",
    "datePublished": "2026-11-13T16:23:45.325Z",
    "dateReserved": "2026-11-13T16:01:00.061Z",
    "dateUpdated": "2026-11-13T16:23:45.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129120 (GCVE-0-2026-129120)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET

Summary

C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/49e0…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-11.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 11.0.506 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "11.0.506",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:45.983Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/49e04a5ccfa08706b1d7e51dce4059f4adce50f3"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L3452"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-11.0.506-before-11.1.515-receive-confirm-bypass-via-recursive-get"
        }
      ],
      "title": "C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129120",
    "datePublished": "2026-11-13T16:23:45.983Z",
    "dateReserved": "2026-11-13T16:00:59.683Z",
    "dateUpdated": "2026-11-13T16:23:45.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129119 (GCVE-0-2026-129119)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 21:12

Title

C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND

Summary

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:11 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/bbf9…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-6.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 6.0.192 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129119",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:11:59.470857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:12:21.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:46.712Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfn3.c#L1798-L1800"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129119",
    "datePublished": "2026-11-13T16:23:46.712Z",
    "dateReserved": "2026-11-13T16:00:59.324Z",
    "dateUpdated": "2026-11-13T21:12:21.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129118 (GCVE-0-2026-129118)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp

Summary

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/8c60…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:47.381Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pc4-gh6q-5h4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/8c60a2bd70f5a78e77ce5d140a17e7a9cdcd5e60"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ck_ssl.c#L3485"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-improper-certificate-hostname-matching-via-dnsname-cmp"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129118",
    "datePublished": "2026-11-13T16:23:47.381Z",
    "dateReserved": "2026-11-13T16:00:58.945Z",
    "dateUpdated": "2026-11-13T16:23:47.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129117 (GCVE-0-2026-129117)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL

Summary

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/0008…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:48.065Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pc4-gh6q-5h4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/0008b429e4fadc8ecfd3d7d661fd55d72e26d527"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ck_ssl.c#L3916"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-missing-hostname-verification-in-authentication-ssl"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129117",
    "datePublished": "2026-11-13T16:23:48.065Z",
    "dateReserved": "2026-11-13T16:00:58.608Z",
    "dateUpdated": "2026-11-13T16:23:48.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129116 (GCVE-0-2026-129116)

Vulnerability from nvd – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login

Summary

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/fdfe…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-7.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 7.0.197 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "7.0.197",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account\u0027s shell access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:48.764Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pc4-gh6q-5h4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/fdfe8f13159f9276d87e02bedba15946b0edda97"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckufio.c#L8249"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-7.0.197-before-11.1.515-iksd-authentication-bypass-via-refused-certificate-login"
        }
      ],
      "title": "C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129116",
    "datePublished": "2026-11-13T16:23:48.764Z",
    "dateReserved": "2026-11-13T16:00:58.249Z",
    "dateUpdated": "2026-11-13T16:23:48.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129116 (GCVE-0-2026-129116)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login

Summary

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/fdfe…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-7.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 7.0.197 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "7.0.197",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account\u0027s shell access."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:48.764Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pc4-gh6q-5h4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/fdfe8f13159f9276d87e02bedba15946b0edda97"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckufio.c#L8249"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-7.0.197-before-11.1.515-iksd-authentication-bypass-via-refused-certificate-login"
        }
      ],
      "title": "C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129116",
    "datePublished": "2026-11-13T16:23:48.764Z",
    "dateReserved": "2026-11-13T16:00:58.249Z",
    "dateUpdated": "2026-11-13T16:23:48.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129117 (GCVE-0-2026-129117)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL

Summary

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/0008…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:48.065Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pc4-gh6q-5h4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/0008b429e4fadc8ecfd3d7d661fd55d72e26d527"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ck_ssl.c#L3916"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-missing-hostname-verification-in-authentication-ssl"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129117",
    "datePublished": "2026-11-13T16:23:48.065Z",
    "dateReserved": "2026-11-13T16:00:58.608Z",
    "dateUpdated": "2026-11-13T16:23:48.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129118 (GCVE-0-2026-129118)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp

Summary

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-297 - Improper Validation of Certificate with Host Mismatch

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/8c60…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:47.381Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5pc4-gh6q-5h4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/8c60a2bd70f5a78e77ce5d140a17e7a9cdcd5e60"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ck_ssl.c#L3485"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-improper-certificate-hostname-matching-via-dnsname-cmp"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129118",
    "datePublished": "2026-11-13T16:23:47.381Z",
    "dateReserved": "2026-11-13T16:00:58.945Z",
    "dateUpdated": "2026-11-13T16:23:47.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129119 (GCVE-0-2026-129119)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 21:12

Title

C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND

Summary

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:11 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/bbf9…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-6.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 6.0.192 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129119",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:11:59.470857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:12:21.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:46.712Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfn3.c#L1798-L1800"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129119",
    "datePublished": "2026-11-13T16:23:46.712Z",
    "dateReserved": "2026-11-13T16:00:59.324Z",
    "dateUpdated": "2026-11-13T21:12:21.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129120 (GCVE-0-2026-129120)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET

Summary

C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/49e0…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-11.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 11.0.506 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "11.0.506",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:45.983Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/49e04a5ccfa08706b1d7e51dce4059f4adce50f3"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L3452"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-11.0.506-before-11.1.515-receive-confirm-bypass-via-recursive-get"
        }
      ],
      "title": "C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129120",
    "datePublished": "2026-11-13T16:23:45.983Z",
    "dateReserved": "2026-11-13T16:00:59.683Z",
    "dateUpdated": "2026-11-13T16:23:45.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129121 (GCVE-0-2026-129121)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE

Summary

C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/9b18…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:45.325Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vhrv-7jrq-95qj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/9b1809b2ce2bcec08b7285deb1b7f0bcbef6a052"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L7668"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-path-traversal-via-ftp-mget-recursive"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129121",
    "datePublished": "2026-11-13T16:23:45.325Z",
    "dateReserved": "2026-11-13T16:01:00.061Z",
    "dateUpdated": "2026-11-13T16:23:45.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129122 (GCVE-0-2026-129122)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation

Summary

C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/39ab…	patch
https://github.com/OpenKermit/ckermit/commit/42cf…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-6.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 6.0.192 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:44.625Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/42cf6decb926f56d606a76262791aaf071955d25"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckctel.c#L5622"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-buffer-overflow-via-telnet-new-environ-negotiation"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129122",
    "datePublished": "2026-11-13T16:23:44.625Z",
    "dateReserved": "2026-11-13T16:01:00.441Z",
    "dateUpdated": "2026-11-13T16:23:44.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129123 (GCVE-0-2026-129123)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 21:11

Title

C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies

Summary

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:11 UTC

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/39ab…	patch
https://github.com/OpenKermit/ckermit/commit/bec2…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-8.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 8.0.200 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129123",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:11:22.241547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:11:40.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "8.0.200",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:43.967Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L11161"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies"
        }
      ],
      "title": "C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129123",
    "datePublished": "2026-11-13T16:23:43.967Z",
    "dateReserved": "2026-11-13T16:01:00.787Z",
    "dateUpdated": "2026-11-13T21:11:40.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129124 (GCVE-0-2026-129124)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE

Summary

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/29c4…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 0 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:43.321Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L1423"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space"
        }
      ],
      "title": "C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129124",
    "datePublished": "2026-11-13T16:23:43.321Z",
    "dateReserved": "2026-11-13T16:01:01.143Z",
    "dateUpdated": "2026-11-13T16:23:43.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129125 (GCVE-0-2026-129125)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY

Summary

C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/85ef…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-6.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 6.0.192 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "6.0.192",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:42.610Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/85ef1da670cee132ea2d8e4eb759bab310ff73c9"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L2544"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-command-execution-via-remote-query"
        }
      ],
      "title": "C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129125",
    "datePublished": "2026-11-13T16:23:42.610Z",
    "dateReserved": "2026-11-13T16:01:01.509Z",
    "dateUpdated": "2026-11-13T16:23:42.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129126 (GCVE-0-2026-129126)

Vulnerability from cvelistv5 – Published: 2026-11-13 16:23 – Updated: 2026-11-13 16:23

Title

C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding

Summary

C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8184 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OpenKermit/ckermit/security/ad…	vendor-advisory
https://github.com/OpenKermit/ckermit/commit/37e5…	patch
https://github.com/OpenKermit/ckermit/releases/ta…	release-notes
https://github.com/OpenKermit/ckermit/blob/v11.0.…	technical-description
https://www.vulncheck.com/advisories/c-kermit-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenKermit	C-Kermit	Affected: 0 , < 11.1.515 (semver)

Date Public

2026-10-31 00:00

Credits

John Goerzen John Goerzen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/OpenKermit/ckermit",
          "product": "C-Kermit",
          "vendor": "OpenKermit",
          "versions": [
            {
              "lessThan": "11.1.515",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Goerzen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Goerzen"
        }
      ],
      "datePublic": "2026-10-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T16:23:41.944Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c5px-7h4c-gj8p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenKermit/ckermit/commit/37e54720779237897bc6887efac42fe138817897"
        },
        {
          "name": "C-Kermit v11.1.515 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L461"
        },
        {
          "name": "VulnCheck Advisory: C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-heap-buffer-overflow-via-putsrv-packet-decoding"
        }
      ],
      "title": "C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129126",
    "datePublished": "2026-11-13T16:23:41.944Z",
    "dateReserved": "2026-11-13T16:01:01.879Z",
    "dateUpdated": "2026-11-13T16:23:41.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by OpenKermit

CVE-2026-129126 (GCVE-0-2026-129126)

CVE-2026-129125 (GCVE-0-2026-129125)

CVE-2026-129124 (GCVE-0-2026-129124)

CVE-2026-129123 (GCVE-0-2026-129123)

CVE-2026-129122 (GCVE-0-2026-129122)

CVE-2026-129121 (GCVE-0-2026-129121)

CVE-2026-129120 (GCVE-0-2026-129120)

CVE-2026-129119 (GCVE-0-2026-129119)

CVE-2026-129118 (GCVE-0-2026-129118)

CVE-2026-129117 (GCVE-0-2026-129117)

CVE-2026-129116 (GCVE-0-2026-129116)

CVE-2026-129116 (GCVE-0-2026-129116)

CVE-2026-129117 (GCVE-0-2026-129117)

CVE-2026-129118 (GCVE-0-2026-129118)

CVE-2026-129119 (GCVE-0-2026-129119)

CVE-2026-129120 (GCVE-0-2026-129120)

CVE-2026-129121 (GCVE-0-2026-129121)

CVE-2026-129122 (GCVE-0-2026-129122)

CVE-2026-129123 (GCVE-0-2026-129123)

CVE-2026-129124 (GCVE-0-2026-129124)

CVE-2026-129125 (GCVE-0-2026-129125)

CVE-2026-129126 (GCVE-0-2026-129126)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by OpenKermit

CVE-2026-129126 (GCVE-0-2026-129126)

CVE-2026-129125 (GCVE-0-2026-129125)

CVE-2026-129124 (GCVE-0-2026-129124)

CVE-2026-129123 (GCVE-0-2026-129123)

CVE-2026-129122 (GCVE-0-2026-129122)

CVE-2026-129121 (GCVE-0-2026-129121)

CVE-2026-129120 (GCVE-0-2026-129120)

CVE-2026-129119 (GCVE-0-2026-129119)

CVE-2026-129118 (GCVE-0-2026-129118)

CVE-2026-129117 (GCVE-0-2026-129117)

CVE-2026-129116 (GCVE-0-2026-129116)

CVE-2026-129116 (GCVE-0-2026-129116)

CVE-2026-129117 (GCVE-0-2026-129117)

CVE-2026-129118 (GCVE-0-2026-129118)

CVE-2026-129119 (GCVE-0-2026-129119)

CVE-2026-129120 (GCVE-0-2026-129120)

CVE-2026-129121 (GCVE-0-2026-129121)

CVE-2026-129122 (GCVE-0-2026-129122)

CVE-2026-129123 (GCVE-0-2026-129123)

CVE-2026-129124 (GCVE-0-2026-129124)

CVE-2026-129125 (GCVE-0-2026-129125)

CVE-2026-129126 (GCVE-0-2026-129126)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.