Vulnerability Description
The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kerlink | Keros | >= 5.0, < 5.12 |
Related Weaknesses (CWE)
References
- https://keros.docs.kerlink.com/security/security_advisories_kerOS5Vendor Advisory
- https://www.bdosecurity.de/en-gb/advisories/cve-2024-39148Third Party Advisory
FAQ
What is CVE-2024-39148?
CVE-2024-39148 is a vulnerability with a CVSS score of 8.1 (HIGH). The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is rea...
How severe is CVE-2024-39148?
CVE-2024-39148 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-39148?
Check the references section above for vendor advisories and patch information. Affected products include: Kerlink Keros.