CVE-2024-41987: TEM Opera Plus FM Transmitter CSRF Flaw

CVE-2024-41987 Overview

CVE-2024-41987 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the TEM Opera Plus FM Family Transmitter application interface. The interface accepts state-changing HTTP requests without validating their origin or authenticity. An attacker can craft a malicious web page that, when visited by an authenticated user, issues requests to the transmitter on the victim's behalf. Successful exploitation lets the attacker invoke administrative functions using the victim's session. The flaw affects broadcast radio equipment classified as industrial control infrastructure by CISA.

Critical Impact
Authenticated administrators visiting an attacker-controlled page can have their session abused to execute privileged actions on the FM transmitter, threatening confidentiality, integrity, and availability of broadcast operations.

Affected Products

TEM Opera Plus FM Family Transmitter (application interface)
Broadcast equipment exposing the affected web management interface
Deployments without an upstream CSRF-aware proxy or network isolation

Discovery Timeline

2024-10-03 - CVE-2024-41987 published to NVD
2024-10-03 - CISA ICS Advisory ICSA-24-277-01 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41987

Vulnerability Analysis

The TEM Opera Plus FM Family Transmitter exposes an administrative web interface that performs sensitive actions over HTTP. The interface does not validate that incoming requests originated from a legitimate session-bound workflow. There is no anti-CSRF token, no Origin or Referer enforcement, and no re-authentication for privileged endpoints. Any browser holding a valid session cookie will silently submit forged requests.

An attacker who can lure an authenticated operator to a controlled page can trigger configuration changes, transmission control, or other administrative operations. Because broadcast transmitters operate as critical infrastructure, abused commands can interrupt service or alter signal parameters.

Root Cause

The root cause is missing request-origin validation on state-changing endpoints, mapped to [CWE-352] Cross-Site Request Forgery. The application trusts ambient session credentials, such as cookies, without verifying that the request came from the application's own UI. There is no synchronizer token, double-submit cookie, or SameSite cookie enforcement documented for the interface.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a page containing an auto-submitting form or a scripted fetch call targeting the transmitter's management URL. When an authenticated administrator visits the page, the browser attaches session cookies and submits the forged request. The transmitter processes the request as if it were issued from the legitimate console. The attacker does not need credentials or prior access to the device. Refer to the CISA ICS Advisory ICSA-24-277-01 for affected versions and additional technical context.

Detection Methods for CVE-2024-41987

Indicators of Compromise

HTTP requests to the transmitter's administrative endpoints with Referer or Origin headers pointing to external or unexpected domains.
Configuration changes correlated with administrator web browsing sessions outside the operations network.
Unexpected POST or GET requests to privileged URLs without preceding legitimate UI navigation.

Detection Strategies

Inspect web server access logs on the transmitter for cross-origin requests targeting administrative paths.
Alert on administrative state changes that occur without a corresponding interactive login flow.
Correlate administrator workstation web proxy logs with transmitter management traffic to identify suspicious referrers.

Monitoring Recommendations

Capture and retain full HTTP headers from the management interface, including Referer, Origin, and User-Agent.
Monitor for configuration drift on the transmitter using periodic baseline comparisons.
Flag administrator sessions where the browser issues requests to the transmitter and external domains in close temporal proximity.

How to Mitigate CVE-2024-41987

Immediate Actions Required

Restrict access to the transmitter management interface to a dedicated, isolated operations network.
Require administrators to use a hardened, dedicated browser or workstation that does not visit untrusted web content.
Terminate administrative sessions immediately after use to limit the window for CSRF abuse.

Patch Information

No vendor patch is referenced in the available advisories at the time of writing. Consult the CISA ICS Advisory ICSA-24-277-01 for vendor mitigation guidance and any subsequent firmware updates from TEM.

Workarounds

Place the management interface behind a VPN or jump host that requires re-authentication.
Enforce network segmentation so the transmitter is unreachable from general-purpose user networks.
Configure perimeter proxies to strip or validate Referer and Origin headers on requests to the device.
Disable session persistence in administrator browsers and use private browsing for management tasks.

bash

# Example firewall rule restricting management access to a jump host
iptables -A INPUT -p tcp --dport 80 -s 10.10.50.5/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP