PT-2024-29676 · Unknown · Tem Opera Plus Fm Family Transmitter

Published 2024-10-03 · Updated 2024-10-04 · CVE-2024-41987

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TEM Opera Plus FM Family Transmitter version 35.45

Description The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. An attacker could launch damaging actions remotely.

Recommendations For TEM Opera Plus FM Family Transmitter version 35.45, patch immediately to prevent exploitation. Monitor for exploit attempts and consider implementing additional security measures to prevent HTTP cross-site request forgery attacks. As a temporary workaround, consider restricting access to the application interface until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-41987

Affected Products

Tem Opera Plus Fm Family Transmitter

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-41987 · Security Note
• https://twitter.com/oktsec/status/1841940779024937208 · Twitter Post
• https://twitter.com/CveFindCom/status/1841901370175099012 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-277-01 · Note
• https://twitter.com/CVEnew/status/1841898800572399681 · Twitter Post
• https://t.me/cvedetector/6921 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1842114504987181367 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1841906702028775647 · Twitter Post
• https://t.me/cvenotify/96961 · Telegram Post