CVE-2024-3741

Summary

Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access.

Affected Software

VendorProductVersion RangeStatus
ElectrolinkCompact DAB Transmitter10Waffected
ElectrolinkCompact DAB Transmitter100Waffected
ElectrolinkCompact DAB Transmitter250Waffected
ElectrolinkMedium DAB Transmitter500Waffected
ElectrolinkMedium DAB Transmitter1kWaffected
ElectrolinkMedium DAB Transmitter2kWaffected
ElectrolinkHigh Power DAB Transmitter2.5kWaffected
ElectrolinkHigh Power DAB Transmitter3kWaffected
ElectrolinkHigh Power DAB Transmitter4kWaffected
ElectrolinkHigh Power DAB Transmitter5kWaffected
ElectrolinkCompact FM TransmitterCompact FM Transmitteraffected
ElectrolinkCompact FM Transmitter500Waffected
ElectrolinkCompact FM Transmitter1kWaffected
ElectrolinkCompact FM Transmitter2kWaffected
ElectrolinkModular FM Transmitter3kWaffected
ElectrolinkModular FM Transmitter5kWaffected
ElectrolinkModular FM Transmitter10kWaffected
ElectrolinkModular FM Transmitter15kWaffected
ElectrolinkModular FM Transmitter20kWaffected
ElectrolinkModular FM Transmitter30kWaffected
ElectrolinkDigital FM Transmitter15W <= 40kWaffected
ElectrolinkVHF TV TransmitterBIaffected
ElectrolinkVHF TV TransmitterBIIIaffected
ElectrolinkUHF TV Transmitter10W <= 5kWaffected

Weaknesses

  • CWE-302: CWE-302

Workarounds

Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink https://electrolink.com/contacts/ for additional information.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References