CVE-2026-129125 · Other
NO FIX YET · SEE WHAT TO DO
C-Kermit versions from 6.0.192 before 11.1.515 let a Kermit client run shell commands on a server even when host commands are disabled. An attacker sends a REMOTE QUERY or a REMOTE ASSIGN macro that reaches RUN, bypassing the nopush restriction and DISABLE HOST.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running C-Kermit as a server that accepts remote Kermit client connections are exposed, because the flaw is reached through REMOTE QUERY and REMOTE ASSIGN. Workstations or installs that only use Kermit locally and never accept remote sessions are less exposed. Teams that do not run Kermit server functions can skip it.
Not affected if host-commands-not-used, no-remote-server
Who cares c-kermit, self-hosted, unix
kermit and look for a version from 6.0.192 up to but not including 11.1.515DISABLE HOST setting is in use, since the flaw bypasses it11.1.515 or laterC-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.