PT-2026-146976
CVE-2026-129118
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName cmp() in ck ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.
Found an issue in the description? Have something to add? Feel free to write us 👾