The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.
References
| Link | Resource |
|---|---|
| https://keros.docs.kerlink.com/security/security_advisories_kerOS5 | Vendor Advisory |
| https://www.bdosecurity.de/en-gb/advisories/cve-2024-39148 | Third Party Advisory |
Configurations
History
23 Dec 2025, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://keros.docs.kerlink.com/security/security_advisories_kerOS5 - Vendor Advisory | |
| References | () https://www.bdosecurity.de/en-gb/advisories/cve-2024-39148 - Third Party Advisory | |
| CPE | cpe:2.3:o:kerlink:keros:*:*:*:*:*:*:*:* | |
| First Time |
Kerlink keros
Kerlink |
01 Dec 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-94 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
01 Dec 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-01 16:15
Updated : 2025-12-23 13:55
NVD link : CVE-2024-39148
Mitre link : CVE-2024-39148
CVE.ORG link : CVE-2024-39148
JSON object : View
Products Affected
kerlink
- keros
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')