CVE-2024-13982: Changsha Spon Communication Technology Co. Ltd Spon IP Network Broadcast System

High severity, CVSS 8.7. EPSS: 1.1% chance of exploitation in the next 30 days.

SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the rj_get_token.php endpoint. The flaw arises from insufficient input validation on the jsondata[url] parameter, which allows attackers to perform directory traversal and access sensitive files on the server. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to read arbitrary files, potentially exposing system configuration, credentials, or internal logic. An affected version range is undefined.

Affected products

• Changsha Spon Communication Technology Co. Ltd Spon IP Network Broadcast System: any version

Published 2025-08-27. Last modified 2026-06-17.