CVE-2024-39148

CVE-2024-39148 affects KerOS prior to 5.12. The issue is in the wmp-agent service, which does not properly validate the so‑called ‘magic URLs’, allowing an unauthenticated attacker to execute arbitrary OS commands as root if the service is reachable over the network. Documents from Red Hat, ENISA...

CVE-2024-32388

CVE-2024-32388 affects Kerlink KerOS prior to 5.12. The root cause is a firewall misconfiguration that causes devices to incorrectly accept specially crafted UDP packets, enabling an attacker to bypass the firewall and access UDP-based services that would otherwise be protected. The connected doc...

CVE-2024-32384

Kerlink KerOS gateways before version 5.10 expose the web interface only over HTTP, with no HTTPS support. This transport security gap enables a man‑in‑the‑middle attacker to intercept/modify traffic between clients and devices. Affected product: Kerlink gateways running KerOS pre‑5.10. Root caus...