CVE-2026-129120: C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET
C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorizedkeys or shell startup files under the current directory, which rqunderroot() accepts silently, enabling persistent access or code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.1.515
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of C-Kermit versions from 11.0.506 before 11.1.515 are exposed when they retrieve files from a malicious Kermit server using recursive GET. The impact is greatest where files written below the current directory can affect SSH authorization or shell startup behavior.
What does an attacker need to exploit it?
An attacker needs to operate or control a Kermit server that the victim connects to and uses for recursive GET. No attacker authentication is required, but the victim must interact with the server and initiate the transfer.
How can I tell whether a system is affected?
Check the installed C-Kermit version and whether it is 11.0.506 or a later version before 11.1.515. Review recursive GET activity from untrusted Kermit servers and inspect the current directory tree for unexpected files, particularly .ssh/authorized_keys and shell startup files.
What should I do if I cannot update immediately?
Do not perform recursive GET operations from untrusted Kermit servers. Use a controlled current directory that cannot influence sensitive SSH or shell configuration files, and review files received from remote servers before allowing them to affect user environments.