CVE-2024-39375

The vulnerability stems from improper authentication verification (CWE-603 — Use of Client-Side Authentication), allowing an attacker to remotely bypass access control mechanisms. An attacker can obtain full administrator privileges without needing valid authentication credentials. The attack requires no interaction from authorized users or special preconditions.

An attacker gains full administrative access to the device, enabling control over the FM transmitter, modification of its configuration, or disruption of its operation. This can lead to unauthorized interference with broadcasting infrastructure.

Apply patches available from the manufacturer in accordance with references provided. Additionally, it is recommended to restrict network access to device management panels exclusively to trusted networks or via VPN, in accordance with CISA ICS Advisory ICSA-24-179-01 recommendations.

Markoni Markoni-D (Compact) and Markoni Markoni-DH (Exciter+Amplifiers) devices — versions specified in manufacturer references (CISA advisory ICSA-24-179-01)