CVE-2024-32388
📋 TL;DR
A firewall misconfiguration in Kerlink devices running KerOS prior to version 5.12 allows attackers to bypass firewall protections by sending specially crafted UDP packets. This enables unauthorized access to UDP-based services that should be protected. Organizations using affected Kerlink devices are vulnerable.
💻 Affected Systems
- Kerlink devices running KerOS
📦 What is this software?
Keros by Kerlink
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive UDP services, potentially leading to data exfiltration, service disruption, or lateral movement within the network.
Likely Case
Unauthorized access to UDP services, potentially exposing management interfaces or other network services that rely on UDP.
If Mitigated
Limited impact if proper network segmentation and additional firewall rules are in place to restrict access to vulnerable devices.
🎯 Exploit Status
Exploitation requires sending specially crafted UDP packets to vulnerable devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: KerOS 5.12 or later
Vendor Advisory: https://keros.docs.kerlink.com/security/security_advisories_kerOS5
Restart Required: Yes
Instructions:
1. Download KerOS 5.12 or later from Kerlink. 2. Follow Kerlink's firmware update procedures. 3. Reboot the device after update.
🔧 Temporary Workarounds
Network ACL Restriction
linuxImplement network access control lists to restrict UDP traffic to vulnerable devices.
iptables -A INPUT -p udp -s <trusted_networks> -j ACCEPT
iptables -A INPUT -p udp -j DROP
External Firewall Rules
allConfigure external firewalls to block unnecessary UDP traffic to affected devices.
🧯 If You Can't Patch
- Isolate vulnerable devices in a separate network segment with strict access controls.
- Implement network monitoring and intrusion detection for suspicious UDP traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check KerOS version via device management interface or CLI. If version is below 5.12, device is vulnerable.Check Version:
keros --versionVerify Fix Applied:
Verify KerOS version is 5.12 or higher after applying the update.📡 Detection & Monitoring
Log Indicators:
- Unexpected UDP connection attempts in firewall logs
- Unusual UDP service access logs
Network Indicators:
- Suspicious UDP packets to Kerlink devices
- Unexpected UDP traffic patterns
SIEM Query:
source_ip=* AND dest_ip=<kerlink_device> AND protocol=UDP AND (port NOT IN [expected_ports])