R Radio Network FM Transmitter 1.07 contains a vulnerability (CWE-312) where the admin password is stored or accessible in cleartext through the system.cgi endpoint. This flaw enables unauthenticated attackers to bypass authentication controls and gain administrative access to FM station configuration. The CVSS 4.0 base score is 8.7, reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact. The vulnerability is publicly known and published but no known exploits are reported in the wild. No vendor patch or advisory is currently available.

Successful exploitation allows an unauthenticated attacker to obtain the admin password, bypass authentication, and control FM station setup. This compromises the confidentiality and integrity of the device's configuration and potentially the broadcast content. The high CVSS score indicates a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for unauthorized access attempts. Avoid exposing the system.cgi endpoint to untrusted networks.