by Kastro
Paper/Archive/CVE-2024-41988

CVE-2024-41988

TEM Opera Plus FM Family Transmitter — Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
38
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 48.2.482 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system serves as the basis for the HTTP2 web server module but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

Affected

ProductAffectedFixed inSource
Opera Plus FM Family Transmitter35.45–CNA
opera_plus_fm_family_transmitter35.45–CISA-ADP

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-277-01