CVE-2024-58277 Overview
CVE-2024-58277 affects R Radio Network FM Transmitter version 1.07. The device exposes the administrator password through the system.cgi endpoint without requiring authentication. An unauthenticated remote attacker can query this endpoint over the network and retrieve credentials in cleartext. With the recovered password, the attacker authenticates as the administrator and gains full control of FM station configuration. The flaw maps to CWE-312: Cleartext Storage of Sensitive Information. The issue was published by ZeroScience as advisory ZSL-2023-5802 and has a public proof of concept on Exploit-DB.
Critical Impact
Unauthenticated network attackers can retrieve the admin password and take over FM station broadcast configuration.
Affected Products
- R Radio Network FM Transmitter 1.07
- Earlier firmware revisions exposing the system.cgi endpoint may also be affected
- Embedded web management interface shipped with the transmitter
Discovery Timeline
- 2025-12-04 - CVE-2024-58277 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-58277
Vulnerability Analysis
The transmitter's web management interface exposes a system.cgi script that returns device configuration data, including the administrator credential. The endpoint does not enforce authentication or session validation before returning the response. Any client capable of reaching the device on the network can issue an HTTP request and parse the admin password directly from the response body.
The flaw is classified under [CWE-312] because sensitive authentication material is stored and transmitted in cleartext rather than hashed or access-controlled. Public exploit code is documented in Exploit-DB entry 51855 and the ZeroScience advisory ZSL-2023-5802.
The EPSS probability is 0.311%, reflecting a low but non-zero likelihood of opportunistic exploitation against exposed devices. Successful exploitation grants the attacker the ability to modify FM broadcast parameters, hijack station identification, or disrupt service.
Root Cause
The system.cgi handler returns persisted configuration values without enforcing an authentication check. The administrator password is stored and served in cleartext rather than as a salted hash, and the management interface has no access control gating on configuration retrieval endpoints.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker locates the transmitter's web interface, issues an HTTP GET request to the system.cgi path, and parses the response for the administrator password. The recovered password is then submitted to the standard login endpoint to obtain authenticated administrative access. Refer to the VulnCheck advisory for technical request and response details.
Detection Methods for CVE-2024-58277
Indicators of Compromise
- Unauthenticated HTTP requests to the /system.cgi path on the transmitter's management interface
- Administrative logins from unfamiliar source IP addresses shortly after system.cgi access
- Unexpected modifications to FM station setup, transmitter frequency, or station identification parameters
- Outbound or inbound HTTP traffic to the device from non-management network segments
Detection Strategies
- Inspect web server and proxy logs for any GET requests to system.cgi originating outside the management VLAN
- Alert on HTTP responses from the device that contain credential-shaped strings or known configuration field names
- Correlate system.cgi access events with subsequent successful admin authentications on the device
Monitoring Recommendations
- Forward transmitter access logs to a central SIEM and create rules for direct system.cgi access
- Monitor configuration drift on FM transmitter devices using periodic configuration snapshots
- Track network scans probing common broadcast equipment management ports on operational networks
How to Mitigate CVE-2024-58277
Immediate Actions Required
- Remove the transmitter's management interface from any internet-reachable network and restrict it to a dedicated management VLAN
- Place the device behind a firewall or reverse proxy that enforces authentication before requests reach system.cgi
- Rotate the administrator password and review configuration history for unauthorized changes
- Audit access logs for prior unauthenticated requests to system.cgi
Patch Information
No vendor patch is referenced in the available advisories. Operators should contact R Radio Network for firmware updates and apply any released fixes that add authentication to configuration endpoints. Until a patched firmware is available, treat the device as an unauthenticated configuration source on any reachable network.
Workarounds
- Restrict inbound access to the device using ACLs that permit only specific operator workstations
- Terminate management traffic at a VPN concentrator so the web interface is never exposed directly
- Disable or proxy the system.cgi endpoint at an upstream reverse proxy that requires authentication
- Segment broadcast equipment from corporate and guest networks to limit lateral discovery
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
