The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is re…
High CVSS 8.1
Summary
The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://keros.docs.kerlink.com/security/security_advisories_kerOS5 Vendor Advisory
- https://www.bdosecurity.de/en-gb/advisories/cve-2024-39148 Third Party Advisory
Timeline
- nvd_ingest NVD