CVE-2026-129117 · Other
NO FIX YET · SEE WHAT TO DO
C-Kermit before 11.1.515 does not check the server name on the certificate during a Telnet TLS handshake. A machine-in-the-middle attacker can present any trusted CA certificate, impersonate the Telnet server, and capture user credentials and session data.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that use C-Kermit as a Telnet client over TLS, especially from untrusted networks where a machine-in-the-middle attacker could sit between client and server. Systems that do not use C-Kermit for Telnet, or that run only on trusted networks, are less exposed. The sources do not say how common Telnet TLS use is among C-Kermit users.
Not affected if no-c-kermit, not-telnet
Who cares c-kermit, telnet, tls
kermit and check the version banner; versions 8.0.200 up to but not including 11.1.515 are affected.11.1.515 or later (per the NVD range before 11.1.515).C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.