{"id":"CVE-2026-129124","kind":"vulnerability","aliases":["CVE-2026-129124"],"related":[],"title":"C-Kermit: unquoted REMOTE arguments let remote clients run shell commands","description":"C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.","summary":"C-Kermit before 11.1.515 passes unquoted arguments from REMOTE WHO and REMOTE SPACE into a shell call. A remote client can append shell metacharacters and run commands on the server host, even when DISABLE HOST is set.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c-kermit","linux","package","self-hosted","unix"],"not_affected_if":["no-remote-clients","version-11.1.515-or-later"],"how_to_check":"- Run `kermit` and check the version banner against `11.1.515`.\n- Check whether the server is reachable from the network and whether it accepts remote Kermit connections.\n- Look for `WHOCMD` or `SPACM2` settings in your Kermit configuration.","fix":"- C-Kermit: move to `11.1.515` or later.","status":"open","published_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","triaged_at":"2026-11-13T17:48:39+00:00","updated_at":"2026-11-13T17:48:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T17:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- C-Kermit: move to `11.1.515` or later.","reach":"network","title":"C-Kermit: unquoted REMOTE arguments let remote clients run shell commands","impact":"high","summary":"C-Kermit before 11.1.515 passes unquoted arguments from REMOTE WHO and REMOTE SPACE into a shell call. A remote client can append shell metacharacters and run commands on the server host, even when DISABLE HOST is set.","audience":"businesses","category":"package","nicknames":[],"who_cares":["c-kermit","self-hosted","linux","unix"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote clients run shell commands on the server host","analyst_note":"Confirm whether the sources state authentication requirements and whether a server must be configured for remote access to be exposed; check the vendor advisory and patch links for details.","how_to_check":"- Run `kermit` and check the version banner against `11.1.515`.\n- Check whether the server is reachable from the network and whether it accepts remote Kermit connections.\n- Look for `WHOCMD` or `SPACM2` settings in your Kermit configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-remote-clients","version-11.1.515-or-later"],"who_is_affected":"Systems running C-Kermit before 11.1.515 that accept remote client connections and let clients issue REMOTE WHO or REMOTE SPACE. The sources say the flaw works even with DISABLE HOST set, so that setting is not a sufficient mitigation. Systems where C-Kermit is only used locally, with no remote clients, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000776,"input_tokens":4655,"output_tokens":621,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129124':15A,18A '-2026':14A,17A '11.1.515':32B,70C 'allow':78C 'append':50B,97C 'argument':6A,35B,88C,101C 'attack':95C 'c':2A,20B,29B,67C 'c-kermit':1A,19B,28B,66C 'call':45B 'client':9A,48B,80C 'command':12A,55B,74C,84C,110C 'contain':71C 'cve':13A,16A 'disabl':62B,117C 'even':60B,115C 'execut':82C,109C 'host':26B,59B,63B,114C,118C 'inject':75C 'kermit':3A,21B,30B,68C 'let':7A 'linux':22B 'metacharact':52B,99C 'os':73C 'packag':23B 'pass':33B,102C 'remot':5A,8A,37B,40B,47B,79C,90C,93C 'run':10A,54B 'self':25B 'self-host':24B 'server':58B,113C 'set':65B,120C 'shell':11A,44B,51B,83C,98C 'space':41B,94C 'spacm2':106C 'suppli':86C 'syscmd':108C 'unix':27B 'unquot':4A,34B,87C 'vulner':76C 'whocmd':104C","nicknames":[],"mitigations":[],"who_affected":"Systems running C-Kermit before 11.1.515 that accept remote client connections and let clients issue REMOTE WHO or REMOTE SPACE. The sources say the flaw works even with DISABLE HOST set, so that setting is not a sufficient mitigation. Systems where C-Kermit is only used locally, with no remote clients, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ckermit","critical","linux","package","selfhosted","unix"],"campaign_type":null,"search_a":"'-129124':15A,18A '-2026':14A,17A 'argument':6A 'c':2A 'c-kermit':1A 'client':9A 'command':12A 'cve':13A,16A 'kermit':3A 'let':7A 'remot':5A,8A 'run':10A 'shell':11A 'unquot':4A","search_b":"'11.1.515':32B 'append':50B 'argument':35B 'c':20B,29B 'c-kermit':19B,28B 'call':45B 'client':48B 'command':55B 'disabl':62B 'even':60B 'host':26B,59B,63B 'kermit':21B,30B 'linux':22B 'metacharact':52B 'packag':23B 'pass':33B 'remot':37B,40B,47B 'run':54B 'self':25B 'self-host':24B 'server':58B 'set':65B 'shell':44B,51B 'space':41B 'unix':27B 'unquot':34B","search_c":"'11.1.515':70C 'allow':78C 'append':97C 'argument':88C,101C 'attack':95C 'c':67C 'c-kermit':66C 'client':80C 'command':74C,84C,110C 'contain':71C 'disabl':117C 'even':115C 'execut':82C,109C 'host':114C,118C 'inject':75C 'kermit':68C 'metacharact':99C 'os':73C 'pass':102C 'remot':79C,90C,93C 'server':113C 'set':120C 'shell':83C,98C 'space':94C 'spacm2':106C 'suppli':86C 'syscmd':108C 'unquot':87C 'vulner':76C 'whocmd':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-31T01:36:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129124","severity":null,"published_at":"2026-11-13T17:17:29+00:00","modified_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","fetched_at":"2026-11-13T17:48:00+00:00","note":null}],"documents":[{"id":148109,"url":"https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148076,"url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148102,"url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-31T01:36:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148112,"url":"https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}