CVE-2024-7007

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to protected areas of the application.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288 CWE-306

Affected software

Vendor	Product	Versions
Positron S.R.L	Broadcast Signal Processor TRA7005	v1.20
positronsrl	broadcast_signal_processor_tra7005	1.20

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-207-02Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-207-02Third Party Advisory, US Government Resource

Timeline

Published: Jul 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-70086.1Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.CVE-2024-70097.1Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLit CVE-2024-70105.9mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the crypto CVE-2024-70116.5Sharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525W CVE-2024-70129.8An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman CVE-2024-70137.8Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code via CVE-2024-70148.1EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 a CVE-2024-70159.8Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse. This CVE-2024-70164.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Smarttek Informatics Smart Doct CVE-2024-70177.5Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox CVE-2024-70187.8Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2024-70194.3Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in speci