CVE-2024-21846

Summary

An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resulting in a denial-of-service scenario.

Affected Software

VendorProductVersion RangeStatus
ElectrolinkCompact DAB Transmitter10Waffected
ElectrolinkCompact DAB Transmitter100Waffected
ElectrolinkCompact DAB Transmitter250Waffected
ElectrolinkMedium DAB Transmitter500Waffected
ElectrolinkMedium DAB Transmitter1kWaffected
ElectrolinkMedium DAB Transmitter2kWaffected
ElectrolinkHigh Power DAB Transmitter2.5kWaffected
ElectrolinkHigh Power DAB Transmitter3kWaffected
ElectrolinkHigh Power DAB Transmitter4kWaffected
ElectrolinkHigh Power DAB Transmitter5kWaffected
ElectrolinkCompact FM TransmitterCompact FM Transmitteraffected
ElectrolinkCompact FM Transmitter500Waffected
ElectrolinkCompact FM Transmitter1kWaffected
ElectrolinkCompact FM Transmitter2kWaffected
ElectrolinkModular FM Transmitter3kWaffected
ElectrolinkModular FM Transmitter5kWaffected
ElectrolinkModular FM Transmitter10kWaffected
ElectrolinkModular FM Transmitter15kWaffected
ElectrolinkModular FM Transmitter20kWaffected
ElectrolinkModular FM Transmitter30kWaffected
ElectrolinkDigital FM Transmitter15W <= 40kWaffected
ElectrolinkVHF TV TransmitterBIaffected
ElectrolinkVHF TV TransmitterBIIIaffected
ElectrolinkUHF TV Transmitter10W <= 5kWaffected

Weaknesses

  • CWE-306: CWE-306 Missing Authentication for Critical Function

Workarounds

Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink https://electrolink.com/contacts/ for additional information.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References