{"id":"CVE-2026-129125","kind":"vulnerability","aliases":["CVE-2026-129125"],"related":[],"title":"C-Kermit: remote query flaw lets clients run shell commands on servers","description":"C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.","summary":"C-Kermit versions from 6.0.192 before 11.1.515 let a Kermit client run shell commands on a server even when host commands are disabled. An attacker sends a REMOTE QUERY or a REMOTE ASSIGN macro that reaches RUN, bypassing the nopush restriction and DISABLE HOST.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c-kermit","other","self-hosted","unix"],"not_affected_if":["host-commands-not-used","no-remote-server"],"how_to_check":"- Check the installed C-Kermit version with `kermit` and look for a version from `6.0.192` up to but not including `11.1.515`\n- Check whether Kermit server mode is running and reachable from the network, for example with REMOTE settings in the Kermit configuration\n- Confirm whether the `DISABLE HOST` setting is in use, since the flaw bypasses it","fix":"- C-Kermit: upgrade to `11.1.515` or later","status":"open","published_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","triaged_at":"2026-11-13T17:48:39+00:00","updated_at":"2026-11-13T17:48:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T17:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- C-Kermit: upgrade to `11.1.515` or later","reach":"network","title":"C-Kermit: remote query flaw lets clients run shell commands on servers","impact":"high","summary":"C-Kermit versions from 6.0.192 before 11.1.515 let a Kermit client run shell commands on a server even when host commands are disabled. An attacker sends a REMOTE QUERY or a REMOTE ASSIGN macro that reaches RUN, bypassing the nopush restriction and DISABLE HOST.","audience":"businesses","category":"other","nicknames":[],"who_cares":["c-kermit","self-hosted","unix"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote clients run arbitrary shell commands on the server","analyst_note":"Check the vendor advisory and release notes linked from the sources to confirm the fixed version and whether server mode must be enabled for exposure.","how_to_check":"- Check the installed C-Kermit version with `kermit` and look for a version from `6.0.192` up to but not including `11.1.515`\n- Check whether Kermit server mode is running and reachable from the network, for example with REMOTE settings in the Kermit configuration\n- Confirm whether the `DISABLE HOST` setting is in use, since the flaw bypasses it","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-remote-server","host-commands-not-used"],"who_is_affected":"Systems running C-Kermit as a server that accepts remote Kermit client connections are exposed, because the flaw is reached through REMOTE QUERY and REMOTE ASSIGN. Workstations or installs that only use Kermit locally and never accept remote sessions are less exposed. Teams that do not run Kermit server functions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0008,"input_tokens":4677,"output_tokens":665,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129125':16A,19A '-2026':15A,18A '11.1.515':35B,78C '6.0.192':33B,76C 'abus':100C 'allow':86C 'assign':61B,120C 'attack':53B,104C 'bypass':66B,127C 'c':2A,21B,29B,74C 'c-kermit':1A,20B,28B,73C 'call':122C 'client':8A,39B,88C 'code':82C 'command':11A,42B,49B,92C,97C,112C 'contain':79C 'cve':14A,17A 'defin':115C 'disabl':51B,71B,98C,132C 'evalu':103C 'even':46B 'execut':83C,123C 'flaw':6A 'function':113C 'host':26B,48B,72B,96C,133C 'invok':110C 'kermit':3A,22B,30B,38B,75C,87C 'let':7A,36B 'macro':62B,117C 'nopush':68B,129C 'queri':5A,57B,102C,109C 'reach':64B,125C 'remot':4A,56B,60B,81C,101C,108C,119C 'restrict':69B,130C 'run':9A,40B,65B,90C,126C 'self':25B 'self-host':24B 'send':54B,106C 'server':13A,45B,94C 'shell':10A,41B,91C 'unix':27B 'version':31B 'via':118C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Systems running C-Kermit as a server that accepts remote Kermit client connections are exposed, because the flaw is reached through REMOTE QUERY and REMOTE ASSIGN. Workstations or installs that only use Kermit locally and never accept remote sessions are less exposed. Teams that do not run Kermit server functions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ckermit","critical","other","selfhosted","unix"],"campaign_type":null,"search_a":"'-129125':16A,19A '-2026':15A,18A 'c':2A 'c-kermit':1A 'client':8A 'command':11A 'cve':14A,17A 'flaw':6A 'kermit':3A 'let':7A 'queri':5A 'remot':4A 'run':9A 'server':13A 'shell':10A","search_b":"'11.1.515':35B '6.0.192':33B 'assign':61B 'attack':53B 'bypass':66B 'c':21B,29B 'c-kermit':20B,28B 'client':39B 'command':42B,49B 'disabl':51B,71B 'even':46B 'host':26B,48B,72B 'kermit':22B,30B,38B 'let':36B 'macro':62B 'nopush':68B 'queri':57B 'reach':64B 'remot':56B,60B 'restrict':69B 'run':40B,65B 'self':25B 'self-host':24B 'send':54B 'server':45B 'shell':41B 'unix':27B 'version':31B","search_c":"'11.1.515':78C '6.0.192':76C 'abus':100C 'allow':86C 'assign':120C 'attack':104C 'bypass':127C 'c':74C 'c-kermit':73C 'call':122C 'client':88C 'code':82C 'command':92C,97C,112C 'contain':79C 'defin':115C 'disabl':98C,132C 'evalu':103C 'execut':83C,123C 'function':113C 'host':96C,133C 'invok':110C 'kermit':75C,87C 'macro':117C 'nopush':129C 'queri':102C,109C 'reach':125C 'remot':81C,101C,108C,119C 'restrict':130C 'run':90C,126C 'send':106C 'server':94C 'shell':91C 'via':118C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-31T01:36:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129125","severity":null,"published_at":"2026-11-13T17:17:29+00:00","modified_at":"2026-11-13T17:17:29+00:00","first_seen_at":"2026-11-13T17:48:01+00:00","fetched_at":"2026-11-13T17:48:01+00:00","note":null}],"documents":[{"id":148113,"url":"https://github.com/OpenKermit/ckermit/commit/85ef1da670cee132ea2d8e4eb759bab310ff73c9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148076,"url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148102,"url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-31T01:36:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148116,"url":"https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-command-execution-via-remote-query","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}