Improper Certificate Validation in C-Kermit Leading to Potential Telnet Impersonation
CVE-2026-129117

7.6HIGH

Key Information:

Vendor

Openkermit

Status
C-kermit
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129117?

C-Kermit versions prior to 11.1.515 are susceptible to an improper certificate validation issue that enables machine-in-the-middle attackers to impersonate Telnet servers. This vulnerability arises because the ssl_reply() function does not invoke ssl_check_server_name(), allowing attackers to refuse START-TLS and present any trusted CA certificate. As a result, they can exploit the situation by capturing sensitive user credentials and session data during Telnet AUTHENTICATION SSL sessions, posing significant risks to users' security.

Affected Version(s)

C-Kermit 8.0.200 < 11.1.515

References

https://github.com/OpenKermit/ckermit/security/advisories...
vendor-advisory
https://github.com/OpenKermit/ckermit/commit/0008b429e4fa...
patch
https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
release-notes

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Goerzen
John Goerzen
.