CVE-2024-39374CWE-798

Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter

Critical · published June 27, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

🚨 A hidden admin account with hard-coded credentials could turn your TELSAT marKoni FM Transmitters into a hacker’s playground! 🔥 Think of it like a secret door in a high-security building that nobody realizes is unlocked — it’s just waiting for someone to stroll right in and take control without a trace. If exploited, an attacker could gain unfettered access to your transmitters, allowing them to manipulate broadcasts, disrupt communications, or even hijack the entire system. The consequences could be absolutely devastating, leading to chaos and potentially significant damage to your operations.

Put simply

Think of it like a secret door in a high-security building that nobody realizes is unlocked — it’s just waiting for someone to stroll right in and take control without a trace. This vulnerability exists due to hard-coded credentials that grant access to a hidden administrative account, meaning an attacker doesn’t even need to authenticate — they simply need to know the secret credentials.

What to do

If exploited, an attacker could gain unfettered access to your transmitters, allowing them to manipulate broadcasts, disrupt communications, or even hijack the entire system. The consequences could be absolutely devastating, leading to chaos and potentially significant damage to your operations. Immediately change any hard-coded credentials and implement unique, complex passwords for all admin accounts. Additionally, audit your security settings and consider updating to patched versions as they become available to ensure you close this gaping door. You've got this! With a little vigilance and action, you can secure your systems and keep the bad guys out! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00524 · 43.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-06-27T16:03Z
EPSS history
Timeline
  • 27 JUN 16:03Z
    Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter
    cvelistv5