Vulnerabilities

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate…

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

OpenKermit

Product

C-Kermit

CVSS v3.1

6.8 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness

CWE-297

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-129117 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 18
   CVE NVD 2h ago

   C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by…

   CVSS 6.8 CVE-2026-129118 OpenKermit