CVE-2025-68920: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68920 is a missing authorization vulnerability in C-Kermit (aka ckermit) that allows a remote Kermit system to overwrite files on the local system or retrieve arbitrary files without proper authorization. It affects C-Kermit versions through 10.0 Beta.12 (aka 416-beta12), with the fix introduced in commit 244644d. The vulnerability was disclosed on December 24, 2025, and is classified under CWE-862 (Missing Authorization). It carries a CVSS v3.1 base score of 8.9 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an insecure default configuration in C-Kermit where SET TERMINAL AUTODOWNLOAD and related settings (SET COMMAND AUTODOWNLOAD) are enabled by default, allowing a remote Kermit server to initiate file transfers to or from the local client without explicit user authorization (CWE-862: Missing Authorization). This behavior was intentionally introduced around 1999 to improve the IKSD (Internet Kermit Service Daemon) user experience, but it effectively grants any connected remote system the ability to read or overwrite local files. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction. A GitHub pull request (PR #20) by researcher jgoerzen identified the issue and proposed fixing the insecure defaults, referencing the Debian bug report for further context (GitHub PR #20, Red Hat Bugzilla).

Successful exploitation allows a remote attacker to overwrite arbitrary files on the local system, potentially corrupting critical data or planting malicious files, and to retrieve sensitive files from the local filesystem, resulting in data exfiltration. The CVSS scoring reflects high confidentiality and integrity impact with a changed scope, meaning the impact extends beyond the vulnerable component itself. Availability impact is rated low, as the primary risks are unauthorized file access and modification rather than service disruption (Red Hat Advisory, GitHub PR #20).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detectable via Nessus plugin 279925 (Tenable, Red Hat Advisory).

1. Reconnaissance: Identify systems running C-Kermit versions up to 10.0 Beta.12 that are accessible over the network and configured to accept remote Kermit connections.
2. Establish a Kermit connection: Connect to the target C-Kermit client from a remote Kermit system (attacker-controlled server), leveraging the Kermit protocol over a network session.
3. Exploit AUTODOWNLOAD default: Because SET TERMINAL AUTODOWNLOAD is ON by default, the remote system can initiate file transfer operations without the local user explicitly authorizing them.
4. Overwrite local files: Send a Kermit SEND command from the remote system targeting specific local file paths to overwrite files (e.g., configuration files, scripts, or binaries) on the victim's local system.
5. Retrieve arbitrary files: Issue a Kermit GET or REMOTE GET command from the remote system to retrieve sensitive files (e.g., /etc/passwd, SSH keys, or application credentials) from the local filesystem without user interaction (GitHub PR #20).

• Network: Unexpected inbound or outbound Kermit protocol traffic (typically over serial lines, SSH tunnels, or TCP connections); connections to unknown remote Kermit servers initiated from systems running C-Kermit.
• File System: Unexpectedly modified or newly created files in user home directories or system directories following a Kermit session; missing or altered configuration files, SSH keys, or scripts.
• Logs: System or application logs showing Kermit file transfer activity (SEND/GET operations) not initiated by the local user; audit logs recording file access or modification events during active Kermit sessions.
• Process: C-Kermit process (ckermit) running with active network connections to unfamiliar remote hosts; child processes spawned by C-Kermit performing unexpected file I/O.

Users should upgrade C-Kermit to a version incorporating commit 244644d or later, which changes the insecure default settings. As a workaround, administrators can manually set SET TERMINAL AUTODOWNLOAD OFF, SET COMMAND AUTODOWNLOAD OFF, and review SET INPUT AUTODOWNLOAD settings in C-Kermit configurations to disable remote-initiated file transfers. Additionally, restricting network access to C-Kermit services, implementing network segmentation, and reviewing filesystem permissions are recommended defensive measures. OpenSUSE has also issued a security update addressing this vulnerability (GitHub PR #20, OpenSUSE Advisory).

The vulnerability was reported by researcher John Goerzen (jgoerzen) via GitHub PR #20 on December 16, 2025, referencing a Debian bug report (bug #1123025). A C-Kermit contributor (jaltman) provided a detailed historical analysis in the PR discussion, arguing that the AUTODOWNLOAD behavior was intentional for remote desktop-like use cases and questioning whether it constitutes a security flaw, while acknowledging that changing the default to OFF may be the least-bad option. The CVE was assigned on December 25, 2025, and was noted in CISA's vulnerability bulletin for the week of December 22, 2025. Social media coverage was limited, with brief mentions on Mastodon and Bluesky (GitHub PR #20, CISA Bulletin).