CVE-2026-129117

Name of the Vulnerable Software and Affected Versions C-Kermit versions 8.0.200 through 11.1.514

Description Improper certificate validation allows machine-in-the-middle attackers to impersonate Telnet servers. This occurs because the ssl reply() function fails to call ssl check server name(). An attacker can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.

Recommendations Update C-Kermit to version 11.1.515 or later.