CVE-2024-54385
Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.
Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The CVE-2024-54385 vulnerability in princeahmed Radio Player allows an attacker to perform Server-Side Request Forgery (SSRF), potentially leading to unauthorized access to internal systems. The vulnerability affects versions up to and including 2.0.83. Given the CVSS score of 7.2 and the potential for internal network exposure, this issue should be addressed promptly to prevent potential data breaches and unauthorized access to sensitive systems.
BSID: BS-2024-GLOBAL-221776-H • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-54385?
What is the CVSS score for CVE-2024-54385?
Is CVE-2024-54385 actively exploited?
How do I remediate CVE-2024-54385?
What NERC-CIP standard applies to CVE-2024-54385?
What IEC 62443 requirement maps to CVE-2024-54385?
| CVE ID | CVE-2024-54385 |
|---|---|
| BSID | BS-2024-GLOBAL-221776-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| Published | 2024-12-16 |
| Last Modified | 2026-04-23 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.83.
Source: NIST NVD / MITRE CVE Database
The SSRF vulnerability in princeahmed Radio Player allows an attacker to craft malicious requests that the server will execute on behalf of the attacker. This can lead to the server making requests to internal systems, potentially exposing sensitive data or internal network resources. The attacker does not need any prior authentication to exploit this vulnerability.
Exploitation Likelihood: MEDIUM
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement a web application firewall (WAF) to monitor and block suspicious requests that may indicate SSRF attempts. Additionally, configure the server to restrict outbound HTTP requests to known, trusted domains.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 as it allows unauthorized access to internal systems, which could compromise the security of the control system environment.
This CVE maps to SR 7.6 as it involves a vulnerability that could allow an attacker to bypass security controls and access internal systems, which is a critical security concern in ICS environments.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | bf16e30816becaefb2cf77d0568c9ba414ba2ea16aa604d3c0a158aad4517d73f085d88e8b8926045e2c56854bb67e7787ea65819542f18fab1dda34b6df0a1e |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →