CVE-2024-13982: SPON IP Network Intercom System rj_get_token.php Arbitrary File Read
SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rjgettoken.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13982?
CVE-2024-13982 has a high severity rating of 8.7 according to the CVSS 4.0 scoring system.
How can I remediate CVE-2024-13982?
To remediate CVE-2024-13982, ensure proper input validation on the jsondata[url] parameter in the rj_get_token.php endpoint.
What types of systems are affected by CVE-2024-13982?
CVE-2024-13982 affects the SPON Communications IP Network Broadcast System and the SPON Communications IP Network Intercom System.
What kind of vulnerability is CVE-2024-13982?
CVE-2024-13982 is classified as an arbitrary file read vulnerability resulting from path traversal due to inadequate input validation.
When was CVE-2024-13982 disclosed?
CVE-2024-13982 was published on August 27, 2025.