{"id":"CVE-2025-68920","aliases":["DEBIAN-CVE-2025-68920","EUVD-2025-205357","GHSA-7wwf-6mwx-wx77","UBUNTU-CVE-2025-68920","openSUSE-SU-2026:10495-1"],"status":"published","title":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote...","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","severity":{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00437,"percentile":0.38446,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2025-12-24T21:47:22Z","modified":"2026-10-17T12:57:39Z","fixes":[{"ecosystem":"Debian:13","package":"ckermit","fixed_in":["416~beta12-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ckermit","fixed_in":["416~beta12-5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ckermit","fixed_in":["9.0.302-20.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.0-1","1:11.0-2","1:11.0-3","1:11.0-4","1:11.0.502-1","1:11.0.502-2","1:11.0.502-2~bpo13+1","1:11.0.504-1","1:11.0.506-1","1:11.0.506-1~bpo13+1","1:11.0.508-1","1:11.0.508-1~bpo13+1","1:11.0.511-1","1:11.0.513-1","402~beta08-1","404~beta09-1","405~beta10-1","405~beta10-2","405~beta10-2~bpo12+1","408~beta11.20240207-1","408~beta11.20240207-1~bpo12+1","414~beta11-1","414~beta11-2","414~beta11-3","414~beta11-3~bpo12+1","416~beta12-1","416~beta12-1.1","416~beta12-2","416~beta12-3","416~beta12-3~bpo13+1","416~beta12-4","416~beta12-5"]},{"source":"osv","ecosystem":"Debian:13","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"416~beta12-1+deb13u1"}]}],"versions":["416~beta12-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"416~beta12-5"}]}],"versions":["416~beta12-1","416~beta12-1.1","416~beta12-2","416~beta12-3","416~beta12-3~bpo13+1","416~beta12-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["302-5","302-5build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["302-5.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["305~alpha02-1","305~alpha04-1","305~alpha05-1","305~alpha05-1build1","305~alpha06-1","305~alpha07-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["405~beta10-1","405~beta10-2","408~beta11.20240207-1","408~beta11.20240207-1build1","408~beta11.20240207-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["414~beta11-3","416~beta12-1","416~beta12-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["416~beta12-3","1:11.0.506-1","1:11.0.508-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["416~beta12-1.1","416~beta12-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ckermit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.302-20.1"}]}]}],"products":[{"vendor":"kermitproject","product":"c-kermit"}],"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123025","tags":["report"]},{"url":"https://github.com/KermitProject/ckermit/pull/20","tags":["report"]},{"url":"https://www.kermitproject.org/ftp/kermit/test/tar/","tags":["report"]},{"url":"https://www.complete.org/kermit/","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68920"},{"url":"https://www.complete.org/kermit"},{"url":"https://www.kermitproject.org/ftp/kermit/test/tar"},{"url":"https://github.com/advisories/GHSA-7wwf-6mwx-wx77"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68920","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68920","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68920","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-68920","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","status":"published","published":"2025-12-24T21:47:22.944Z","modified":"2025-12-24T22:43:13.676Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-205357","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","status":"published","published":"2025-12-24T21:47:22Z","modified":"2025-12-24T22:43:13Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:01.342725Z"}],"ghsa":[{"id":"GHSA-7wwf-6mwx-wx77","title":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote...","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","status":"published","published":"2025-12-25T00:30:17Z","modified":"2025-12-25T00:30:23Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:05:22.620437Z"}],"nvd":[{"id":"CVE-2025-68920","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","status":"published","published":"2025-12-24T22:15:43.55Z","modified":"2026-10-07T13:10:00.713Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:53.683969Z"}],"osv":[{"id":"DEBIAN-CVE-2025-68920","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","status":"published","published":"2025-12-24T22:15:43.55Z","modified":"2026-10-08T10:00:25.628081567Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-68920","description":"C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system.","status":"published","published":"2025-12-24T22:15:00Z","modified":"2026-10-17T12:57:39.937659604Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"openSUSE-SU-2026:10495-1","title":"ckermit-9.0.302-20.1 on GA media","description":"These are all security issues fixed in the ckermit-9.0.302-20.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-04-08T07:50:15.709519Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}