PatchSiren cyber security CVE debrief

CVE-2024-39373 marKoni CVE debrief

A critical command injection vulnerability in TELSAT marKoni FM Transmitters allows unauthenticated remote attackers to gain administrative access by manipulating device settings. The vulnerability affects Markoni-D (Compact) and Markoni-DH (Exciter+Amplifiers) FM Transmitters running versions prior to 2.0.1. With a CVSS 3.1 score of 9.8, this represents maximum severity due to network attack vector, low complexity, no required privileges, and complete confidentiality, integrity, and availability impact. The issue was disclosed by CISA on June 27, 2024, with vendor-supplied firmware version 2.0.1 available as remediation. Organizations operating these broadcast transmission systems should prioritize patching due to the critical risk of complete system compromise.

Vendor: marKoni
Product: Unknown
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-06-27
Original CVE updated: 2024-06-27
Advisory published: 2024-06-27
Advisory updated: 2024-06-27

Who should care

Broadcast media organizations, radio station operators, telecommunications providers, and critical infrastructure operators utilizing marKoni FM transmission equipment. Security teams responsible for industrial control systems and operational technology environments should prioritize assessment and remediation.

Technical summary

The vulnerability exists in the settings manipulation functionality of TELSAT marKoni FM Transmitters. Insufficient input validation allows command injection through configuration parameters, enabling remote attackers to execute arbitrary system commands with administrative privileges. The attack requires no authentication and can be conducted over the network with minimal complexity. Successful exploitation grants complete control over the transmitter device, potentially allowing attackers to disrupt broadcast operations, modify transmission parameters, or pivot to connected network segments. The vulnerability is resolved in firmware version 2.0.1.

Defensive priority

critical

Recommended defensive actions

Upgrade affected marKoni FM Transmitters to firmware version 2.0.1 or later immediately
Contact marKoni directly for patch acquisition and installation guidance if not already on supported version
Restrict network access to transmitter management interfaces to authorized administrative hosts only
Monitor for unauthorized configuration changes or unexpected administrative sessions
Apply network segmentation to isolate FM transmitter management interfaces from untrusted networks
Review and implement CISA ICS recommended practices for industrial control system security

Evidence notes

Vulnerability confirmed through CISA ICS advisory ICSA-24-179-01. Affected products explicitly identified as marKoni Markoni-D (Compact) FM Transmitters versions <2.0.1 and marKoni Markoni-DH (Exciter+Amplifiers) FM Transmitters versions <2.0.1. Remediation version 2.0.1 confirmed available from vendor.

Sources and references

Verified primary and authoritative sources

CVE-2024-39373 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-39373

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-39373 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-39373

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-179-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.