Kerlink KerOS wmp-agent Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability has been identified in the wmp-agent service of Kerlink's KerOS operating system, affecting versions 5.0 through 5.11. The vulnerability arises because the service does not properly validate 'magic URLs', allowing unauthenticated remote attackers to execute arbitrary operating system commands as root. This issue is present when the service is accessible over the network, although it is typically protected by a local firewall.
Impact
Exploitation of this vulnerability allows for arbitrary operating system command execution as the root user.
Remediation
Users are advised to upgrade to KerOS version 5.12.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.