OpenKermit vulnerabilities
We track 6 vulnerabilities in OpenKermit products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest OpenKermit vulnerabilities
- 8.1 High severity
C-Kermit: Heap-based Buffer Overflow
C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or
- 8.1 High severity
C-Kermit: Incorrect Authorization
C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command f
- 8.1 High severity
C-Kermit: Improper Neutralization of Special Elements used in an OS Command
C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WH
- 8.8 High severity
C-Kermit: Buffer Copy without Checking Size of Input
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send
- 7.5 High severity
C-Kermit: Out-of-bounds Write
C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send o
- 7.5 High severity
C-Kermit: Improper Authentication
C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused acc