CVE-2026-129125: C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY
C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
C-Kermitto a version that resolves this vulnerability.Fixed in 11.1.515
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
C-Kermit versions 6.0.192 before 11.1.515 are affected when they accept attacker-controlled Kermit protocol commands. The described bypass works even where host commands have been disabled with nopush or DISABLE HOST.
What must an attacker be able to do to exploit it?
An attacker needs the ability to send REMOTE QUERY or REMOTE ASSIGN commands to a vulnerable Kermit client. They can invoke the command function through REMOTE QUERY, or define a macro and use execute to reach RUN.
Does disabling host commands prevent exploitation?
No. The vulnerability specifically bypasses the nopush restriction and DISABLE HOST controls, allowing shell commands to be run despite host commands being disabled.