# CVE-2024-32385: Kerlink KerOS information disclosure via mDNS

Source: https://junglewise.ai/threats/cve-2024-32385-kerlink-keros-information-disclosure-via-mdns  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2024-32385 · Severity: medium · CVSS 4.3 · Published 2026-07-16

Kerlink KerOS, the operating system for industrial IoT gateways like the Wirnet iStation, is affected by an information disclosure vulnerability. An attacker on the same local network can view device-specific identifiers that could be used to gain unauthorized access to management services, including network monitoring tools. This could lead to a compromise of the gateway's configuration or the broader IoT network it manages.

Technologies: [Kerlink KerOS](https://junglewise.ai/threats/technologies/keros), [Kerlink Wirnet iStation 868](https://junglewise.ai/threats/technologies/wirnet-istation-868). Vendors: [Kerlink](https://junglewise.ai/threats/vendors/kerlink).

## Quick answers

**Is CVE-2024-32385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-32385 being exploited in the wild.

**How severe is CVE-2024-32385?** Medium severity, with a CVSS score of 4.3, published 16 July 2026.

**Which products and versions are affected?** Kerlink KerOS <= 4.3.3; Kerlink Wirnet iStation 868 4.3.3_20200803132042.

**Is there a fix for CVE-2024-32385?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-32385 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2024-32385?** Check whether you run Kerlink KerOS or Kerlink Wirnet iStation 868 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Kerlink KerOS versions 4.3.3 and below due to the exposure of device-specific data via Multicast DNS (mDNS). An unauthenticated attacker located on the same adjacent network can query mDNS to obtain the 'boardID' and 'revisionID' components. This sensitive information can be leveraged to gain privileged access to management services, such as SNMP. The vendor has stated that KerOS 4 and 5 are end-of-life (EOL) and recommends migrating to KerOS 6, which is not affected by this issue.

## Affected products

- Kerlink KerOS <= 4.3.3
- Kerlink Wirnet iStation 868 4.3.3_20200803132042

## Timeline

- 2024-03-19: disclosed: Vulnerability reported to Kerlink
- 2024-03-29: other: Vendor confirmed the vulnerabilities
- 2025-09-06: other: Vendor informed researcher that KerOS 4 is EOL
- 2026-05-27: advisory: Public disclosure by BDO Security

## References

- [https://www.bdosecurity.de/de-de/advisories/cve-2024-32385](https://www.bdosecurity.de/de-de/advisories/cve-2024-32385)
- [https://www.kerlink.com/](https://www.kerlink.com/)

## Related threats

- [Kerlink KerOS Buffer Overflow in SNMP Update Mechanism](https://junglewise.ai/threats/cve-2024-32389-kerlink-keros-buffer-overflow-in-snmp-update-mechanism)
- [Kerlink KerOS predictable SNMP community string](https://junglewise.ai/threats/cve-2024-32387-kerlink-keros-predictable-snmp-community-string)
- [Kerlink KerOS directory traversal in SNMP update mechanism](https://junglewise.ai/threats/cve-2024-32386-kerlink-keros-directory-traversal-in-snmp-update-mechanism)
- [The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an…](https://junglewise.ai/threats/cve-2024-39148-the-service-wmp-agent-of-keros-prior-5-12-does-not-properly)
- [Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted…](https://junglewise.ai/threats/cve-2024-32388-due-to-a-firewall-misconfiguration-kerlink-devices-running-keros)