KerOS vulnerabilities

A buffer overflow vulnerability in KerOS software of Kerlink Wirnet iStation 868 version 4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the update URLs component.

A vulnerability in the KerOS software of the Kerlink Wirnet iStation 868 allows a remote attacker to obtain sensitive information via the community string component. The issue affects version 4.3.3_20200803132042.

A directory traversal vulnerability in the KerOS software of the Kerlink Wirnet iStation 868 allows a remote attacker to read sensitive files via the SNMP update mechanism.

A vulnerability in the KerOS software of the Kerlink Wirnet iStation 868 allows a remote attacker to obtain sensitive information via boardID and revisionID components.

The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.