VulnerabilityDeferred

CVE-2024-41987

The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests.

HIGH 8.6EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-352
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.