Executive brief
Kerlink KerOS, the operating system for industrial IoT gateways like the Wirnet iStation, contains a security flaw in its network management protocol (SNMP). An attacker on the same local network can predict the security credentials (community strings) used to manage the device because they are generated using non-random hardware information. This could allow an unauthorized person to access sensitive diagnostic information or device configurations, potentially compromising the privacy and integrity of the IoT network.
Technical details
The SNMP implementation in Kerlink KerOS (v4.3.3 and below) utilizes predictable SNMP community strings. These strings are derived from hardware-dependent information rather than sufficiently random values (CWE-330). When combined with other information disclosure vulnerabilities, an attacker located on the same adjacent network can recover the community string through a low-volume brute-force attack. Successful exploitation allows for unauthorized read access to sensitive device information via SNMP. The vendor has stated that KerOS 4 and 5 are End-of-Life (EOL) and recommends migrating to KerOS 6, which is not affected.
Affected products
- Kerlink KerOS <= 4.3.3
- Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042
Timeline
- 2024-03-19: disclosed: Vulnerability reported to Kerlink
- 2024-03-29: other: Vendor confirmed the vulnerabilities
- 2025-09-06: other: Vendor informed researchers that KerOS 4 is EOL and KerOS 6 is unaffected
- 2026-05-27: advisory: Public disclosure of the CVE
- 2026-07-16: other: CVE published to NVD