CVE-2024-39148

The KerOS operating system (versions prior to 5.12 ) is vulnerable to a security flaw in the wmp-agent service. The service fails to properly validate so-called 'magic URLs' , which could allow an unauthenticated remote attacker to execute arbitrary OS commands with root privileges if the service...

CVE-2024-32388

CVE-2024-32388 affects Kerlink KerOS prior to 5.12. The root cause is a firewall misconfiguration that causes devices to incorrectly accept specially crafted UDP packets, enabling an attacker to bypass the firewall and access UDP-based services that would otherwise be protected. The connected doc...

CVE-2024-32384

Kerlink KerOS gateways before version 5.10 expose the web interface only over HTTP, with no HTTPS support. This transport security gap enables a man‑in‑the‑middle attacker to intercept/modify traffic between clients and devices. Affected product: Kerlink gateways running KerOS pre‑5.10. Root caus...