CVE-2024-21872

Summary

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter.

Affected Software

VendorProductVersion RangeStatus
ElectrolinkCompact DAB Transmitter10Waffected
ElectrolinkCompact DAB Transmitter100Waffected
ElectrolinkCompact DAB Transmitter250Waffected
ElectrolinkMedium DAB Transmitter500Waffected
ElectrolinkMedium DAB Transmitter1kWaffected
ElectrolinkMedium DAB Transmitter2kWaffected
ElectrolinkHigh Power DAB Transmitter2.5kWaffected
ElectrolinkHigh Power DAB Transmitter3kWaffected
ElectrolinkHigh Power DAB Transmitter4kWaffected
ElectrolinkHigh Power DAB Transmitter5kWaffected
ElectrolinkCompact FM TransmitterCompact FM Transmitteraffected
ElectrolinkCompact FM Transmitter500Waffected
ElectrolinkCompact FM Transmitter1kWaffected
ElectrolinkCompact FM Transmitter2kWaffected
ElectrolinkModular FM Transmitter3kWaffected
ElectrolinkModular FM Transmitter5kWaffected
ElectrolinkModular FM Transmitter10kWaffected
ElectrolinkModular FM Transmitter15kWaffected
ElectrolinkModular FM Transmitter20kWaffected
ElectrolinkModular FM Transmitter30kWaffected
ElectrolinkDigital FM Transmitter15W <= 40kWaffected
ElectrolinkVHF TV TransmitterBIaffected
ElectrolinkVHF TV TransmitterBIIIaffected
ElectrolinkUHF TV Transmitter10W <= 5kWaffected

Weaknesses

  • CWE-565: CWE-565 Reliance on Cookies without Validation and Integrity Checking

Workarounds

Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink https://electrolink.com/contacts/ for additional information.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References