Path Traversal in Changsha Spon Communication Technology Co. Ltd. Ip Network Broadcast System
CVE-2024-13982
SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.011 (63.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 63.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- blog.csdn.net/qq_36618918/article/details/135505570 (technical-description, exploit)
- sponcomm.com/collections/ip-intercom-system (product)
- www.vulncheck.com/advisories/spon-ip-network-intercom-system-arbitrary-file-read (third-party-advisory)
Frequently asked questions
- What is CVE-2024-13982?
- CVE-2024-13982 is a vulnerability in Changsha Spon Communication Technology Co. Ltd. Ip Network Broadcast System, classified under Path Traversal. Published 2025-08-27.
- Is CVE-2024-13982 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.