CVE-2024-39373

An attacker can exploit the vulnerability by manipulating device settings, which leads to injection and execution of arbitrary system commands (command injection, CWE-77). The attack is possible remotely, without authentication and without user interaction, making it particularly dangerous in industrial control system (ICS) environments. The vulnerability results from improper validation of input data passed to system commands.

A successful attack allows an attacker to take full control of the device with administrator privileges, which in an FM transmitter environment can lead to disruption or interruption of radio transmission and further compromise of the infrastructure.

Patches available from the manufacturer should be applied according to the references — detailed guidelines are contained in the CISA ICS advisory ICSA-24-179-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-01). It is also recommended to isolate devices from public networks and restrict network access to trusted hosts.

Markoni Markoni-D (Compact) Firmware devices, Markoni Markoni-Dh (Exciter+Amplifiers) Firmware — specific versions indicated in the manufacturer's references (CISA ICS advisory ICSA-24-179-01)