Executive brief
A security vulnerability exists in the Kerlink KerOS firmware used in industrial IoT gateways. An attacker can exploit the device's network management system to overwrite critical system files. This could lead to a complete takeover of the device, potentially disrupting IoT network operations or allowing unauthorized access to sensitive data.
Technical details
The SNMP implementation in KerOS versions 4.3.3 and below contains a path traversal vulnerability within its update mechanism. An attacker can provide a malicious URL pointing to a specially crafted firmware update package. Because the system fails to properly validate the package contents and destination paths, the attacker can overwrite arbitrary files on the device's filesystem. This can be leveraged to achieve full system compromise and unauthorized privileged access. The vulnerability is addressed by migrating to KerOS 6, as versions 4 and 5 are end-of-life.
Affected products
- Kerlink KerOS <= 4.3.3
- Kerlink Wirnet iStation 868 <= 4.3.3
Timeline
- 2024-03-19: other: Vulnerability reported to vendor
- 2024-03-29: other: Vendor confirmed the vulnerability
- 2025-09-06: other: Vendor declared KerOS 4 End-of-Life (EOL)
- 2026-04-01: other: Coordinated disclosure agreed upon
- 2026-05-27: disclosed: Initial advisory publication by BDO Security
- 2026-07-16: advisory: CVE published in NVD