CVE-2026-129124
C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.
| CWE | CWE-78 |
| Vendor | openkermit |
| Product | c-kermit |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for openkermit c-kermit
Be the first to know when new high vulnerabilities affecting openkermit c-kermit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
OpenKermit / C-Kermit
0 < 11.1.515
References
github.com: https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p github.com: https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57 github.com: https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515 github.com: https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L1423 vulncheck.com: https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space
Credits
John Goerzen John Goerzen