High severity8.1NVD Advisory· Published Dec 1, 2025· Updated Jun 17, 2026

CVE-2024-39148

Description

The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kerberos Agent/Kerberosinferred
Range: <5.12
Kerlink/KerOS2 versions
cpe:2.3:o:kerlink:keros:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:kerlink:keros:*:*:*:*:*:*:*:*range: >=5.0,<5.12
- (no CPE)range: <5.12
KerOS/wmp-agentllm-create
Range: <5.12

Patches

Vulnerability mechanics

References

keros.docs.kerlink.com/security/security_advisories_kerOS5nvdVendor Advisory
www.bdosecurity.de/en-gb/advisories/cve-2024-39148nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000