CVE-2026-129124

critical

Description

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

References

https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space

https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p

https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515

https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57

https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L1423

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125555

Details

Source: Mitre, NVD

Published: 2026-11-13

Updated: 2026-11-13

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 9.2

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.01316