CVE-2024-39148

The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://keros.docs.kerlink.com/security/security_advisories_kerOS5	Vendor Advisory
https://www.bdosecurity.de/en-gb/advisories/cve-2024-39148	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:kerlink:keros:*:*:*:*:*:*:*:*

History

26 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El servicio wmp-agent de KerOS anterior a 5.12 no valida correctamente las denominadas 'magic URLs', permitiendo a un atacante remoto no autenticado ejecutar comandos arbitrarios del sistema operativo como root cuando el servicio es accesible a través de la red. Típicamente, el servicio está protegido mediante un cortafuegos local.

Information

Published : 2025-12-01 16:15

Updated : 2026-09-26 21:10

NVD link : CVE-2024-39148

Mitre link : CVE-2024-39148

CVE.ORG link : CVE-2024-39148

JSON object : View

Products Affected

kerlink

keros

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-39148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-39148", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-01T19:24:29.200129Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-01T16:15:49.603", "references": [{"url": "https://keros.docs.kerlink.com/security/security_advisories_kerOS5", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.bdosecurity.de/en-gb/advisories/cve-2024-39148", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The service wmp-agent of KerOS prior 5.12 does not properly validate so-called \u2018magic URLs\u2019 allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall."}, {"lang": "es", "value": "El servicio wmp-agent de KerOS anterior a 5.12 no valida correctamente las denominadas 'magic URLs', permitiendo a un atacante remoto no autenticado ejecutar comandos arbitrarios del sistema operativo como root cuando el servicio es accesible a trav\u00e9s de la red. T\u00edpicamente, el servicio est\u00e1 protegido mediante un cortafuegos local."}], "lastModified": "2026-09-26T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:kerlink:keros:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DD39BA2-AA69-42C7-B5D0-AD8012CD1879", "versionEndExcluding": "5.12", "versionStartIncluding": "5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}