PT-2024-29677 · Unknown · Tem Opera Plus Fm Family Transmitter

Published 2024-10-03 · Updated 2024-10-04 · CVE-2024-41988

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TEM Opera Plus FM Family Transmitter (affected versions not specified)

Description The TEM Opera Plus FM Family Transmitter has an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system is used by the HTTP2 web server module, the SNMP module, and other applications for basic read-only storage capabilities. An attacker can exploit this to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-41988

Affected Products

Tem Opera Plus Fm Family Transmitter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-41988 · Security Note
• https://t.me/cvenotify/96962 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-277-01 · Note
• https://t.me/cvedetector/6918 · Telegram Post
• https://twitter.com/CVEnew/status/1841898799402287300 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1841905421163835406 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1842114504987181367 · Twitter Post
• https://twitter.com/CveFindCom/status/1841901297764634728 · Twitter Post