June 27, 2024, noon | CISA

All CISA Advisories www.cisa.gov

View CSAF


1. EXECUTIVE SUMMARY



  • CVSS v4 9.3

  • ATTENTION: Exploitable remotely/low attack complexity/public exploits are available

  • Vendor: marKoni

  • Equipment: Markoni-D (Compact) FM Transmitters, Markoni-DH (Exciter+Amplifiers) FM Transmitters

  • Vulnerabilities: Command Injection, Use of Hard-coded Credentials, Use of Client-Side Authentication, Improper Access Control


2. RISK EVALUATION


Successful exploitation of these vulnerabilities could allow an attacker to tamper with the product to bypass authentication or perform remote code execution.


3. TECHNICAL DETAILS


3.1 AFFECTED PRODUCTS


The following …

access access control attack attacker attention authentication client client-side command command injection complexity control credentials csaf cvss equipment evaluation executive exploitation exploits hard hard-coded credentials improper access control injection low public risk telsat transmitter vendor vulnerabilities

Technology Risk & Controls Manager

@ LegalAndGeneral | London, United Kingdom

Solutions Architect - Prisma Cloud

@ Palo Alto Networks | Munich, Germany

Security Operations Engineer

@ Cognite | Oslo

Ingénieur Cybersécurité PKI

@ Alter Solutions | PARIS, France

Cyber Security Project Engineer

@ Dezign Concepts LLC | Chantilly, VA

Cloud Cybersecurity Incident Response Lead

@ Maveris | Martinsburg, West Virginia, United States