CVE-2026-129124 in C-Kermit
Summary
by MITRE • 11/13/2026
C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in C-Kermit versions prior to 11.1.515 represents a critical OS command injection flaw within the remote execution capabilities of the software. C-Kermit, widely used for file transfers and terminal emulation over various network protocols including TCP/IP, serial lines, and asynchronous connections, contains specific commands designed to execute operations on a remote host. The core technical defect lies in how these remote commands handle user-supplied arguments before passing them to the underlying operating system shell. Specifically, when utilizing the REMOTE WHO or REMOTE SPACE functionalities, the application fails to properly sanitize or quote input parameters. This lack of rigorous input validation allows an attacker to inject arbitrary shell metacharacters into the command string. The vulnerability is particularly severe because it affects commands like WHOCMD and SPACM2, which are processed through a function named syscmd that directly interfaces with the system's command interpreter without adequate escaping mechanisms.
From a technical perspective, this flaw constitutes an OS Command Injection vulnerability as defined by CWE-78 in the Common Weakness Enumeration standard. The root cause is insufficient separation between data and code within the application logic. When a remote client sends arguments to these specific commands, C-Kermit concatenates them directly into a shell command string without ensuring that special characters such as semicolons, pipes, or ampersands are escaped or quoted. Consequently, if an attacker appends malicious payloads containing shell metacharacters to the legitimate arguments, the operating system interprets these appended sequences as distinct commands rather than part of the original argument data. This allows for arbitrary command execution on the server host with the privileges granted to the C-Kermit process.
The operational impact of this vulnerability is significant due to its potential for remote code execution without authentication in certain configurations, or privilege escalation if authenticated access is required but weak credentials are used. An attacker can leverage this flaw to execute any system command available to the user running the C-Kermit daemon. This could lead to complete compromise of the affected host, including data exfiltration, installation of backdoors, pivoting into internal networks, or denial of service through resource exhaustion. Notably, the vulnerability persists even when the DISABLE HOST option is configured in some contexts, suggesting that the security control intended to restrict remote command execution can be bypassed by exploiting this injection point. This undermines a key defense-in-depth measure and exposes systems running older versions of C-Kermit to severe risk.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands such as sh or cmd.exe depending on the operating system. Attackers would typically use this capability during the Execution phase of an attack chain to establish persistence or escalate privileges after initial access has been gained through other means, although in some scenarios it could serve as a primary entry vector if exposed services are accessible without strong authentication. The ability to execute commands remotely makes C-Kermit a high-value target for lateral movement within compromised networks where legacy systems may still rely on this tool for administrative tasks or file transfers.
Mitigation strategies must prioritize immediate remediation by upgrading C-Kermit to version 11.1.515 or later, which addresses the input validation flaws in WHOCMD and SPACM2 processing. If an upgrade is not immediately feasible, administrators should disable remote command execution features entirely if they are not strictly required for business operations. This involves configuring C-Kermit to restrict REMOTE commands to trusted sources only and ensuring that DISABLE HOST settings are correctly applied across all relevant configuration files. Additionally, network-level controls such as firewalls can be employed to limit access to the ports used by C-Kermit services, reducing the attack surface available to potential adversaries. Regular security audits of legacy software configurations are essential to identify similar injection points in other components that may share the same underlying architectural weaknesses regarding shell command construction and execution.