Remote Code Execution in C-Kermit by OpenKermit

CVE-2026-129125

What is CVE-2026-129125?

C-Kermit versions 6.0.192 and earlier than 11.1.515 are subject to a remote code execution vulnerability that permits Kermit clients to execute unauthorized shell commands on servers. This exploitation occurs by manipulating the REMOTE QUERY evaluation process. Attackers may leverage this vulnerability by sending crafted REMOTE QUERY commands, or by defining a macro through REMOTE ASSIGN and using the execute function to circumvent security measures that typically restrict command executions, including the nopush restriction and DISABLE HOST features.

References