# CVE-2024-32386: Kerlink KerOS directory traversal in SNMP update mechanism

Source: https://junglewise.ai/threats/cve-2024-32386-kerlink-keros-directory-traversal-in-snmp-update-mechanism  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2024-32386 · Severity: high · CVSS 7.3 · Published 2026-07-16

A security vulnerability exists in the Kerlink KerOS firmware used in industrial IoT gateways. An attacker can exploit the device's network management system to overwrite critical system files. This could lead to a complete takeover of the device, potentially disrupting IoT network operations or allowing unauthorized access to sensitive data.

Technologies: [Kerlink KerOS](https://junglewise.ai/threats/technologies/keros), [Kerlink Wirnet iStation 868](https://junglewise.ai/threats/technologies/wirnet-istation-868). Vendors: [Kerlink](https://junglewise.ai/threats/vendors/kerlink).

## Quick answers

**Is CVE-2024-32386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-32386 being exploited in the wild.

**How severe is CVE-2024-32386?** High severity, with a CVSS score of 7.3, published 16 July 2026.

**Which products and versions are affected?** Kerlink KerOS <= 4.3.3; Kerlink Wirnet iStation 868 <= 4.3.3.

**Is there a fix for CVE-2024-32386?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-32386 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2024-32386?** Check whether you run Kerlink KerOS or Kerlink Wirnet iStation 868 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SNMP implementation in KerOS versions 4.3.3 and below contains a path traversal vulnerability within its update mechanism. An attacker can provide a malicious URL pointing to a specially crafted firmware update package. Because the system fails to properly validate the package contents and destination paths, the attacker can overwrite arbitrary files on the device's filesystem. This can be leveraged to achieve full system compromise and unauthorized privileged access. The vulnerability is addressed by migrating to KerOS 6, as versions 4 and 5 are end-of-life.

## Affected products

- Kerlink KerOS <= 4.3.3
- Kerlink Wirnet iStation 868 <= 4.3.3

## Timeline

- 2024-03-19: other: Vulnerability reported to vendor
- 2024-03-29: other: Vendor confirmed the vulnerability
- 2025-09-06: other: Vendor declared KerOS 4 End-of-Life (EOL)
- 2026-04-01: other: Coordinated disclosure agreed upon
- 2026-05-27: disclosed: Initial advisory publication by BDO Security
- 2026-07-16: advisory: CVE published in NVD

## References

- [https://www.bdosecurity.de/de-de/advisories/cve-2024-32386](https://www.bdosecurity.de/de-de/advisories/cve-2024-32386)
- [https://www.kerlink.com/](https://www.kerlink.com/)

## Related threats

- [Kerlink KerOS Buffer Overflow in SNMP Update Mechanism](https://junglewise.ai/threats/cve-2024-32389-kerlink-keros-buffer-overflow-in-snmp-update-mechanism)
- [Kerlink KerOS predictable SNMP community string](https://junglewise.ai/threats/cve-2024-32387-kerlink-keros-predictable-snmp-community-string)
- [Kerlink KerOS information disclosure via mDNS](https://junglewise.ai/threats/cve-2024-32385-kerlink-keros-information-disclosure-via-mdns)
- [The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an…](https://junglewise.ai/threats/cve-2024-39148-the-service-wmp-agent-of-keros-prior-5-12-does-not-properly)
- [Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted…](https://junglewise.ai/threats/cve-2024-32388-due-to-a-firewall-misconfiguration-kerlink-devices-running-keros)