RECEIVE CONFIRM Bypass Vulnerability in C-Kermit by OpenKermit

CVE-2026-129120

What is CVE-2026-129120?

C-Kermit versions before 11.1.515 contain a vulnerability that enables malicious Kermit servers to bypass the RECEIVE CONFIRM prompts, allowing them to write files to the target system without user consent. This is achieved through a flaw in the recursive GET root computation, enabling attackers to inject unauthorized files such as .ssh/authorized_keys, potentially granting persistent access or facilitating remote code execution. It is crucial for users to update to the latest version to mitigate risks associated with this vulnerability.

References