Kerlink vulnerabilities
Published CVEs affecting Kerlink products: 3 record(s), with severity, exploitation and fixes.
CVE-2024-39148
High · 8.1
CWE-94 Dec 1, 2025
Code Injection in Kerlink Keros
The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.
CVE-2024-32388
Medium · 5.3
CWE-402 Dec 1, 2025
Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12…
Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. This allows an attacker to bypass the firewall and access UDP-based services that would otherwise be protected.
CVE-2024-32384
High · 7.4
CWE-319 Dec 1, 2025
Cleartext Transmission of Sensitive Information in Kerlink Keros
Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device.