Kerlink Gateways KerOS Unencrypted Web Interface Vulnerability

A vulnerability exists in Kerlink gateways running KerOS versions prior to 5.10, where the web interface is only available over HTTP, lacking HTTPS support. This absence of transport layer security enables a man-in-the-middle attacker to intercept and alter traffic between the client and the device.

Impact

Exploitation of this vulnerability allows for interception and modification of web traffic between the user and the gateway, potentially leading to unauthorized changes or data manipulation.

Remediation

Users can upgrade to KerOS version 5.10 or later, which includes HTTPS support. For detailed instructions on enabling HTTPS, please refer to the KerOS Wiki.