{"id":"CVE-2024-41987","state":"PUBLISHED","title":"Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter","description":"The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.","publishedAt":"2024-10-03T17:38:49.500Z","updatedAt":"2024-10-03T18:49:33.596Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["TEM Opera Plus FM Family Transmitter"],"affected":[{"vendor":"TEM","product":"Opera Plus FM Family Transmitter","defaultStatus":"unaffected","versions":[{"version":"35.45","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/41xxx/CVE-2024-41987.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-41987","state":"PUBLISHED","datePublished":"2024-10-03T17:38:49.500Z","dateUpdated":"2024-10-03T18:49:33.596Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-07-25T16:53:53.053Z"},"containers":{"cna":{"title":"Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter","descriptions":[{"lang":"en","value":"The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site."}],"affected":[{"vendor":"TEM","product":"Opera Plus FM Family Transmitter","defaultStatus":"unaffected","versions":[{"version":"35.45","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01","tags":["government-resource"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-10-03T17:38:49.500Z"},"credits":[{"lang":"en","type":"finder","value":"CISA discovered a public Proof of Concept (PoC) as authored by Gjoko Krstic and reported it to TEM."}],"source":{"discovery":"UNKNOWN"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">TEM has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.tem-italy.it/en/contacts/\">TEM</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;for additional information.</span>\n\n<br>"}],"value":"TEM has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact  TEM https://www.tem-italy.it/en/contacts/  for additional information."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-03T18:49:25.359506Z","id":"CVE-2024-41987","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-03T18:49:33.596Z"}}]}}}