What’s Vulnerable › Vulnerabilities

CVE-2024-13982: SPON IP Network Intercom System rj_get_token.php Arbitrary File Read

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-27 · updated 2026-06-17
• Weakness: CWE-22

Description

SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.

Affected products

• Changsha SPON Communication Technology Co. Ltd. SPON IP Network Broadcast System: all versions

References

• https://blog.csdn.net/qq_36618918/article/details/135505570
• https://sponcomm.com/collections/ip-intercom-system
• https://www.vulncheck.com/advisories/spon-ip-network-intercom-system-arbitrary-file-read

Get alerted when CVE-2024-13982 or the next vulnerability affects your stack