CVE-2025-68920CWE-862broken-access-control

CVE-2025-68920

High · published December 25, 2025

CVSS v3.1
8.9
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

⚡ A remote Kermit system can overwrite files on your local setup, making this vulnerability a slippery slope to chaos! Think of it like a house guest who can not only rearrange your furniture but also take your valuables — that's the risk here! The Kermit protocol is letting in someone with a spare key to your local files. An attacker could exploit this vulnerability to overwrite or retrieve any file on your system, potentially exposing sensitive data or disrupting operations. This could lead to data loss, unauthorized access, and a major headache in trying to restore your system's integrity. A breach like this could be absolutely devastating!

Put simply

Think of it like a house guest who can not only rearrange your furniture but also take your valuables — that's the risk here! The Kermit protocol is letting in someone with a spare key to your local files. This vulnerability in C-Kermit allows a remote Kermit system to perform unauthorized file operations, including overwriting local files and accessing arbitrary file data. It's a severe flaw that compromises the trusted relationship between systems using the Kermit protocol.

What to do

An attacker could exploit this vulnerability to overwrite or retrieve any file on your system, potentially exposing sensitive data or disrupting operations. This could lead to data loss, unauthorized access, and a major headache in trying to restore your system's integrity. A breach like this could be absolutely devastating! To remediate this, update C-Kermit to version 10.0 Beta.12 or later to ensure that this vulnerability is patched. Additionally, review your network configurations to restrict access to the Kermit protocol where unnecessary. Regular audits of your file permissions can also help mitigate risks. You've got this! Secure your system now and keep those pesky intruders at bay! 🛡️

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-25T03:15Z
References (4)
EPSS history
Timeline
  • 24 DEC 21:47Z
    C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve…
    cvelistv5