C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.

The arbitrary file access vulnerability in C-Kermit poses a significant risk. An attacker controlling a remote Kermit system can exploit this flaw to overwrite critical system files, potentially leading to denial of service or complete system takeover. Alternatively, the attacker could retrieve sensitive data stored on the local system, including configuration files, user credentials, or proprietary information. The blast radius extends to any system running a vulnerable version of C-Kermit and accessible via a Kermit connection. While no direct precedent exists mirroring this exact vulnerability, the potential for remote file manipulation shares similarities with other file access vulnerabilities that have led to significant data breaches and system compromises.

1. आरक्षित2025-12-24
2. प्रकाशित2025-12-24
3. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-68920 is to upgrade C-Kermit to version 244644d or later. If immediate upgrading is not feasible due to compatibility concerns or system downtime requirements, consider implementing temporary workarounds. Restrict Kermit access to trusted networks and systems only. Implement strict file access controls on the affected system to limit the potential impact of a successful exploit. Monitor Kermit connections for suspicious activity. After upgrading to version 244644d, verify the fix by attempting a file transfer from a remote Kermit system and confirming that file access is restricted to authorized locations.