CVE-2025-68920
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote...
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
- Record
CVE-2025-68920- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2025-205357
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
- Record
EUVD-2025-205357- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7wwf-6mwx-wx77
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote...
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
- Record
GHSA-7wwf-6mwx-wx77- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
- Record
CVE-2025-68920- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-68920
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
- Record
DEBIAN-CVE-2025-68920- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-68920
C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.
- Record
UBUNTU-CVE-2025-68920- CVSS 3.1
- 8.9 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10495-1 No score
ckermit-9.0.302-20.1 on GA media
These are all security issues fixed in the ckermit-9.0.302-20.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10495-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ckermitDebian:12 |
All versions, plus listed versions 1:11.0-11:11.0-21:11.0-31:11.0-41:11.0.502-1 Show 27 moreShow less1:11.0.502-21:11.0.502-2~bpo13+11:11.0.504-11:11.0.506-11:11.0.506-1~bpo13+11:11.0.508-11:11.0.508-1~bpo13+11:11.0.511-11:11.0.513-1402~beta08-1404~beta09-1405~beta10-1405~beta10-2405~beta10-2~bpo12+1408~beta11.20240207-1408~beta11.20240207-1~bpo12+1414~beta11-1414~beta11-2414~beta11-3414~beta11-3~bpo12+1416~beta12-1416~beta12-1.1416~beta12-2416~beta12-3416~beta12-3~bpo13+1416~beta12-4416~beta12-5 |
None known |
ckermitDebian:13 |
before 416~beta12-1+deb13u1, plus listed versions 416~beta12-1 |
416~beta12-1+deb13u1 |
ckermitDebian:14 |
before 416~beta12-5, plus listed versions 416~beta12-1416~beta12-1.1416~beta12-2416~beta12-3416~beta12-3~bpo13+1416~beta12-4 |
416~beta12-5 |
ckermitUbuntu:16.04:LTS |
All versions, plus listed versions 302-5302-5build1 |
None known |
ckermitUbuntu:18.04:LTS |
All versions, plus listed versions 302-5.3 |
None known |
ckermitUbuntu:22.04:LTS |
All versions, plus listed versions 305~alpha02-1305~alpha04-1305~alpha05-1305~alpha05-1build1305~alpha06-1305~alpha07-1 |
None known |
ckermitUbuntu:24.04:LTS |
All versions, plus listed versions 405~beta10-1405~beta10-2408~beta11.20240207-1408~beta11.20240207-1build1408~beta11.20240207-1build2 |
None known |
ckermitUbuntu:25.10 |
All versions, plus listed versions 414~beta11-3416~beta12-1416~beta12-1.1 |
None known |
ckermitUbuntu:26.10 |
All versions, plus listed versions 416~beta12-31:11.0.506-11:11.0.508-1 |
None known |
ckermitUbuntu:26.04:LTS |
All versions, plus listed versions 416~beta12-1.1416~beta12-3 |
None known |
ckermitopenSUSE:Tumbleweed |
before 9.0.302-20.1 | 9.0.302-20.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-68920 is a high vulnerability (CVSS 8.9) in Kermitproject C-kermit, published December 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in ckermit 416~beta12-1+deb13u1.