CVE-2024-41988CWE-306

Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter

Critical · published October 3, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system serves as the basis for the HTTP2 web server module but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00590 · 47.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-10-03T17:40Z
EPSS history
Timeline
  • 03 OCT 17:40Z
    Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter
    cvelistv5