{"affected":[{"conditional":false,"product":"keros","source":"NVD","vendor":"kerlink","versions":[{"greaterThanOrEqual":"5.0","lessThan":"5.10","status":"affected","version":"*","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:kerlink:keros:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10","versionStartIncluding":"5.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-32384","cwes":["CWE-319"],"description":"Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":6.8,"severity":"medium","source":"NVD: cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794168600187,"publishedAt":1764605749217,"references":[{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://keros.docs.kerlink.com/security/security_advisories_kerOS5"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://www.bdosecurity.de/en-gb/advisories/cve-2024-32384"}],"remediation":[],"revision":"dd24c4138fd39044fd8205d77f49ee0d150142f105e396421ba839ac33b66f4d","sources":[{"modifiedAt":1794168600187,"name":"NVD","retrievedAt":1794183353540,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32384"}],"ssvc":{"assessedAt":1764605531361,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2024-32384","updatedAt":1794183353540}