# CVE-2024-32387: Kerlink KerOS predictable SNMP community string

Source: https://junglewise.ai/threats/cve-2024-32387-kerlink-keros-predictable-snmp-community-string  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2024-32387 · Severity: medium · CVSS 5.7 · Published 2026-07-16

Kerlink KerOS, the operating system for industrial IoT gateways like the Wirnet iStation, contains a security flaw in its network management protocol (SNMP). An attacker on the same local network can predict the security credentials (community strings) used to manage the device because they are generated using non-random hardware information. This could allow an unauthorized person to access sensitive diagnostic information or device configurations, potentially compromising the privacy and integrity of the IoT network.

Technologies: [Kerlink KerOS](https://junglewise.ai/threats/technologies/keros), [Kerlink Wirnet iStation 868](https://junglewise.ai/threats/technologies/wirnet-istation-868). Vendors: [Kerlink](https://junglewise.ai/threats/vendors/kerlink).

## Quick answers

**Is CVE-2024-32387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-32387 being exploited in the wild.

**How severe is CVE-2024-32387?** Medium severity, with a CVSS score of 5.7, published 16 July 2026.

**Which products and versions are affected?** Kerlink KerOS <= 4.3.3; Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042.

**Is there a fix for CVE-2024-32387?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-32387 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2024-32387?** Check whether you run Kerlink KerOS or Kerlink Wirnet iStation 868 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SNMP implementation in Kerlink KerOS (v4.3.3 and below) utilizes predictable SNMP community strings. These strings are derived from hardware-dependent information rather than sufficiently random values (CWE-330). When combined with other information disclosure vulnerabilities, an attacker located on the same adjacent network can recover the community string through a low-volume brute-force attack. Successful exploitation allows for unauthorized read access to sensitive device information via SNMP. The vendor has stated that KerOS 4 and 5 are End-of-Life (EOL) and recommends migrating to KerOS 6, which is not affected.

## Affected products

- Kerlink KerOS <= 4.3.3
- Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042

## Timeline

- 2024-03-19: disclosed: Vulnerability reported to Kerlink
- 2024-03-29: other: Vendor confirmed the vulnerabilities
- 2025-09-06: other: Vendor informed researchers that KerOS 4 is EOL and KerOS 6 is unaffected
- 2026-05-27: advisory: Public disclosure of the CVE
- 2026-07-16: other: CVE published to NVD

## References

- [https://www.bdosecurity.de/de-de/advisories/cve-2024-32387](https://www.bdosecurity.de/de-de/advisories/cve-2024-32387)
- [https://www.kerlink.com/](https://www.kerlink.com/)

## Related threats

- [Kerlink KerOS Buffer Overflow in SNMP Update Mechanism](https://junglewise.ai/threats/cve-2024-32389-kerlink-keros-buffer-overflow-in-snmp-update-mechanism)
- [Kerlink KerOS directory traversal in SNMP update mechanism](https://junglewise.ai/threats/cve-2024-32386-kerlink-keros-directory-traversal-in-snmp-update-mechanism)
- [Kerlink KerOS information disclosure via mDNS](https://junglewise.ai/threats/cve-2024-32385-kerlink-keros-information-disclosure-via-mdns)
- [The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an…](https://junglewise.ai/threats/cve-2024-39148-the-service-wmp-agent-of-keros-prior-5-12-does-not-properly)
- [Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted…](https://junglewise.ai/threats/cve-2024-32388-due-to-a-firewall-misconfiguration-kerlink-devices-running-keros)