OS Command Injection Vulnerability in C-Kermit by OpenKermit
CVE-2026-129124

9.2CRITICAL

Key Information:

Vendor

Openkermit

Status
C-kermit
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129124?

C-Kermit versions prior to 11.1.515 are susceptible to an OS command injection vulnerability. This flaw enables remote clients to execute arbitrary shell commands by sending unquoted arguments through the REMOTE WHO or REMOTE SPACE commands. Attackers can exploit this vulnerability by appending shell metacharacters to arguments processed by WHOCMD or SPACM2, allowing them to execute commands on the server host, even when configurations like DISABLE HOST are enabled. Users are advised to upgrade to the latest version to mitigate this risk.

Affected Version(s)

C-Kermit 0 < 11.1.515

References

https://github.com/OpenKermit/ckermit/security/advisories...
vendor-advisory
https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d6...
patch
https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
release-notes

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Goerzen
John Goerzen
.