{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/openkermit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["C-Kermit"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["OpenKermit"],"content_html":"\u003cp\u003eA code quality sweep of C-Kermit has identified three distinct security vulnerabilities. The most critical issue allows for remote code execution when a user interacts with a malicious peer. Additional vulnerabilities include an authentication bypass and TLS certificate spoofing. These issues are currently documented under GitHub Security Advisories; CVE identifiers are pending allocation. Users are advised to monitor the upstream repository for patch releases.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of the RCE vulnerability could allow an attacker to achieve remote code execution on the system running C-Kermit by simulating a malicious peer connection. The authentication bypass and TLS spoofing flaws compromise the integrity and confidentiality of communication sessions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor the C-Kermit GitHub repository and security advisories for the release of patched versions.\u003c/li\u003e\n\u003cli\u003eAudit systems running C-Kermit to identify and restrict exposure to untrusted or public peer connections.\u003c/li\u003e\n\u003cli\u003eUntil patches are available, avoid connecting C-Kermit to untrusted remote peers, as these interactions facilitate the observed RCE and authentication bypass vectors.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T05:05:00Z","date_published":"2026-11-02T05:05:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-c-kermit-vulnerabilities/","summary":"Multiple vulnerabilities were discovered in the C-Kermit communication software during a code audit, including a remote code execution vector exploitable by a malicious peer and an authentication bypass with TLS certificate spoofing.","title":"C-Kermit: Multiple vulnerabilities including RCE","url":"https://feed.craftedsignal.io/briefs/2026-11-c-kermit-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenKermit","version":"https://jsonfeed.org/version/1.1"}