CVE-2024-32384: Kerlink Gateway HTTP Exposure – A Man-in-the-Middle Risk

Overview

CVE-2024-32384 identifies a security vulnerability in Kerlink gateways running KerOS versions prior to 5.10. These gateways expose their web interface solely over HTTP, meaning that all communication between the client (e.g., a user’s web browser) and the gateway is unencrypted. This lack of encryption creates a significant risk of man-in-the-middle (MitM) attacks, where an attacker can intercept and potentially modify sensitive data being transmitted.

Technical Details

The core issue is the absence of HTTPS support for the Kerlink gateway’s web interface. HTTP transmits data in plain text, making it vulnerable to eavesdropping. A MitM attacker positioned between the client and the gateway can capture the traffic, including usernames, passwords, configuration settings, and other sensitive information. Furthermore, the attacker can inject malicious code or modify the data being transmitted, potentially gaining unauthorized access or disrupting the gateway’s functionality.

CVSS Analysis

The vulnerability has been assigned a CVSS score of 6.8 (Medium). This score reflects the potential impact of a successful attack, considering factors such as confidentiality, integrity, and availability. While not the highest severity rating, the ease of exploitation in local network environments makes this a serious concern.

Possible Impact

Successful exploitation of CVE-2024-32384 can lead to several critical consequences:

• Data Theft: Attackers can steal sensitive data transmitted between the client and the gateway, including credentials and configuration details.
• Unauthorized Access: Gaining access to the gateway’s web interface allows attackers to modify settings, potentially compromising the entire network or IoT devices connected to the gateway.
• Malware Injection: An attacker could inject malicious code into the gateway’s firmware, leading to persistent compromise.
• Denial of Service: Manipulation of the gateway’s configuration can lead to a denial-of-service condition, disrupting network connectivity.

Mitigation or Patch Steps

The primary mitigation is to upgrade the Kerlink gateway’s KerOS firmware to version 5.10 or later. This version includes support for HTTPS, encrypting the communication between the client and the gateway and preventing MitM attacks.

1. Upgrade Firmware: Follow the official Kerlink documentation to upgrade the gateway’s firmware to the latest available version (5.10 or later). Refer to the Kerlink documentation for detailed instructions.
2. Network Segmentation: Isolate the Kerlink gateway on a separate network segment to limit the impact of a potential compromise.
3. Monitor Network Traffic: Implement network monitoring tools to detect suspicious activity that may indicate a MitM attack.
4. Strong Passwords: Ensure strong and unique passwords are used for the gateway’s web interface.

References

• Kerlink Security Advisories (kerOS5)
• BDO Security Advisory: CVE-2024-32384