CVE-2026-129122

C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tnsnenv in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before...

CVE-2026-129121

C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE...

CVE-2026-129120

C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorizedkeys or shell startup files...

CVE-2026-129126

C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write...

CVE-2026-129124

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd, executing...

CVE-2026-129123

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or lo...

CVE-2026-129125

C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE...

CVE-2026-129118

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSNamecmp in ckssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question...

CVE-2026-129117

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because sslreply never calls sslcheckservername. Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any...

CVE-2026-129116

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTHVALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account...

CVE-2026-129119

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt,...

EUVD-2026-125519

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTHVALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account...

CVE-2026-129116 C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTHVALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account...

CVE-2026-129116

C-Kermit versions 7.0.197 before 11.1.515 are vulnerable to an authentication bypass in the IKSD SSL build. The root cause involves a flaw where a refused certificate login leaves the Telnet authentication state at AUTH_VALID . An attacker possessing a trusted certificate mapped to a refused acco...

CVE-2026-129117

C-Kermit versions 8.0.200 before 11.1.515 are vulnerable to an improper certificate validation flaw. The root cause is that the ssl_reply() function fails to call ssl_check_server_name(), leading to a lack of hostname verification during AUTHENTICATION SSL . This allows a machine-in-the-middle at...

CVE-2026-129117 C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because sslreply never calls sslcheckservername. Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any...

EUVD-2026-125518

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because sslreply never calls sslcheckservername. Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any...

CVE-2026-129118

C-Kermit versions 8.0.200 before 11.1.515 are vulnerable to an improper certificate hostname validation flaw within the dNSName_cmp() function in ck_ssl.c. Attackers can abuse wildcard matching—specifically involving asterisks, question marks, brackets, or empty labels—to impersonate hosts using ...

CVE-2026-129118 C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSNamecmp in ckssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question...

EUVD-2026-125561

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSNamecmp in ckssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question...