Sources: National Vulnerability Database, CVE.org, CISA KEV, FIRST EPSS
CVE-2026-129123 Overview
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.
Critical Impact
Affected Products
- C-Kermit: see the vendor advisory for the exact affected versions
Discovery Timeline
- 2026-11-13: CVE-2026-129123 published to the National Vulnerability Database by disclosure@vulncheck.com
- 2026-11-13: last updated in the NVD database
Technical Details for CVE-2026-129123
Vulnerability Analysis
CVE-2026-129123 is a Classic Buffer Overflow weakness (CWE-120: Classic Buffer Overflow) in C-Kermit. Based on its CVSS vector, the flaw can be reached over the network, needs no login, and relies on a user taking an action. Data is copied into a buffer without checking its size.
With a CVSS base score of 8.7, apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Root Cause
The weakness is classified as CWE-120: Classic Buffer Overflow. Data is copied into a buffer without checking its size.
Attack Vector
Based on the CVSS vector, the flaw can be reached over the network, needs no login, and relies on a user taking an action. Attack complexity is low complexity.
No exploitation in the wild is confirmed by CISA at the time of the last update. Check the references below for any vendor or researcher proof of concept.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Detection Methods for CVE-2026-129123
Detection Strategies
- Inventory every instance of C-Kermit and compare the running version with the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Run an authenticated vulnerability scan once your scanner ships a check for this CVE.
Monitoring Recommendations
- Forward C-Kermit application, access and audit logs to your SIEM for retrospective hunting.
- Alert on new processes, configuration changes or outbound connections from the affected service.
- Track the vendor advisory and the CISA KEV catalog for changes in exploitation status.
How to Mitigate CVE-2026-129123
Immediate Actions Required
- Apply the fixed version of C-Kermit named in the vendor advisory.
- Prioritize internet facing and business critical instances first.
- Rescan after the change to confirm the exposure is closed.
Patch Information
Use the fixed version listed in the vendor advisory for C-Kermit.
Workarounds
- If patching must wait, restrict network access to the affected service and place it behind authentication or a web application firewall rule.
CWE References
- CWE-120: Classic Buffer Overflow More CVEs with this weakness
Technical References
This entry is built directly from NVD, CISA KEV and EPSS data. Verify fixed versions in the vendor advisory before you deploy.
Frequently asked questions
Related CVEs
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects azerothcore-wotlk: through v4.0.0.
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is used in `sprintf` without validating variable sizes, it could lead to a buffer overflow vulnerability.
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it could lead to buffer overflow.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-129123 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications