CVE-2024-39148: KerOS wmp-agent RCE Vulnerability

CVE-2024-39148 Overview

CVE-2024-39148 is a critical command injection vulnerability affecting the wmp-agent service in Kerlink KerOS prior to version 5.12. The vulnerability stems from improper validation of "magic URLs," enabling unauthenticated remote attackers to execute arbitrary operating system commands with root privileges when the service is network-accessible.

This command injection flaw (CWE-94: Improper Control of Generation of Code) represents a severe security risk for IoT gateway infrastructure, as successful exploitation grants complete system control to attackers without requiring any authentication.

Critical Impact

Unauthenticated remote attackers can achieve root-level command execution on vulnerable KerOS devices, potentially compromising entire IoT gateway networks and connected infrastructure.

Affected Products

• Kerlink KerOS versions prior to 5.12
• Devices running the vulnerable wmp-agent service with network exposure
• IoT gateways utilizing KerOS firmware

Discovery Timeline

• 2025-12-01 - CVE-2024-39148 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2024-39148

Vulnerability Analysis

The vulnerability resides in the wmp-agent service of KerOS, which fails to properly sanitize and validate incoming "magic URLs." This service component processes specially crafted URL requests and, due to insufficient input validation, allows attackers to inject arbitrary shell commands that are subsequently executed by the underlying operating system.

The CVSS 3.1 score of 8.1 (HIGH) reflects the severity of this vulnerability:

• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The EPSS (Exploit Prediction Scoring System) indicates a probability of 0.147% with a percentile ranking of 35.705, suggesting moderate likelihood of exploitation in the wild.

Root Cause

The root cause is classified under CWE-94 (Improper Control of Generation of Code / Code Injection). The wmp-agent service accepts URL parameters that are processed and incorporated into system commands without adequate sanitization or validation. When crafted input containing shell metacharacters or command sequences is submitted, the service executes these as part of its normal URL processing workflow, running with root privileges.

The lack of input validation on the "magic URL" parsing mechanism allows command separators and shell operators to be injected, breaking out of the intended execution context.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker must have network access to the wmp-agent service, which typically listens for incoming requests. While Kerlink notes that the service is typically protected by a local firewall, misconfigurations or intentional exposure for remote management purposes may leave devices vulnerable.

The attack flow involves:

1. Identifying a KerOS device with an exposed wmp-agent service
2. Crafting a malicious URL containing OS command injection payloads
3. Sending the crafted request to the service endpoint
4. The wmp-agent executes the injected commands with root privileges

The vulnerability mechanism involves improper handling of special URL parameters that bypass input validation. Malicious payloads embedded in these "magic URLs" are passed directly to system command execution functions. For detailed technical analysis and proof-of-concept information, refer to the BDO Security advisory.

Detection Methods for CVE-2024-39148

Indicators of Compromise

• Unusual network traffic directed at the wmp-agent service port
• Unexpected outbound connections or reverse shells originating from KerOS devices
• Anomalous process creation with parent process as wmp-agent
• System log entries showing command execution outside normal operational patterns
• Modified system files or configuration changes on KerOS devices

Detection Strategies

Network Monitoring:

• Monitor for HTTP/HTTPS requests to the wmp-agent service containing suspicious characters such as semicolons, pipe operators, backticks, or shell command sequences
• Implement deep packet inspection rules to identify command injection patterns in URL parameters
• Alert on unexpected external connections to management service ports

Endpoint Detection:

• Monitor process creation events on KerOS devices for unexpected child processes of wmp-agent
• Track file system changes and new file creation in sensitive directories
• Log and alert on privilege escalation attempts or unusual root-level activity

SentinelOne Singularity Platform provides comprehensive protection through:

• Behavioral AI detection of anomalous command execution patterns
• Real-time process monitoring to identify injection-based attacks
• Network traffic analysis for malicious URL patterns
• Automated response capabilities to contain compromised devices

Monitoring Recommendations

Organizations should implement continuous monitoring of IoT gateway infrastructure with particular attention to:

• Service exposure audits to identify wmp-agent services accessible from untrusted networks
• Regular log analysis for command injection attack patterns
• Network segmentation monitoring to ensure IoT devices remain properly isolated
• Firmware version tracking to identify devices requiring updates

How to Mitigate CVE-2024-39148

Immediate Actions Required

• Verify firmware version: Check all KerOS devices and identify those running versions prior to 5.12
• Network isolation: Ensure wmp-agent service is not exposed to untrusted networks; verify firewall rules are properly configured
• Restrict access: Implement strict network access controls limiting connectivity to the service to authorized management systems only
• Enable logging: Increase logging verbosity on KerOS devices to capture potential exploitation attempts
• Plan upgrade path: Schedule firmware updates to version 5.12 or later for all vulnerable devices

Patch Information

Kerlink has addressed this vulnerability in KerOS version 5.12 and later. Organizations should:

1. Consult the official Kerlink Security Advisories for detailed upgrade instructions
2. Download the latest firmware from Kerlink's official distribution channels
3. Test firmware updates in a staging environment before production deployment
4. Maintain backup configurations before applying updates

Workarounds

If immediate patching is not feasible, implement the following compensating controls:

Firewall Hardening:
Ensure the wmp-agent service is protected by host-based and network firewalls. Restrict access to only trusted management IP addresses and networks.

Network Segmentation:
Place vulnerable KerOS devices in isolated network segments with strict ingress and egress controls. Prevent direct internet access to management interfaces.

Access Control Lists:
Implement ACLs on network devices to limit which systems can communicate with the wmp-agent service.

# Example iptables rules to restrict wmp-agent access
# Allow only from trusted management network (e.g., 10.0.0.0/24)
iptables -A INPUT -s 10.0.0.0/24 -p tcp --dport <wmp-agent-port> -j ACCEPT
iptables -A INPUT -p tcp --dport <wmp-agent-port> -j DROP