CVE-2026-129125

Name of the Vulnerable Software and Affected Versions C-Kermit versions 6.0.192 through 11.1.514

Description Remote code execution is possible on servers where host commands are disabled. This occurs by abusing REMOTE QUERY evaluation, allowing clients to execute shell commands. Attackers can achieve this by sending a REMOTE QUERY that invokes the command function or by defining a macro through REMOTE ASSIGN and calling execute to reach RUN, which bypasses the nopush restriction and DISABLE HOST setting.

Recommendations Update C-Kermit to version 11.1.515 or later.