CVE-2024-3742

Summary

Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.

Affected Software

VendorProductVersion RangeStatus
ElectrolinkCompact DAB Transmitter10Waffected
ElectrolinkCompact DAB Transmitter100Waffected
ElectrolinkCompact DAB Transmitter250Waffected
ElectrolinkMedium DAB Transmitter500Waffected
ElectrolinkMedium DAB Transmitter1kWaffected
ElectrolinkMedium DAB Transmitter2kWaffected
ElectrolinkHigh Power DAB Transmitter2.5kWaffected
ElectrolinkHigh Power DAB Transmitter3kWaffected
ElectrolinkHigh Power DAB Transmitter4kWaffected
ElectrolinkHigh Power DAB Transmitter5kWaffected
ElectrolinkCompact FM TransmitterCompact FM Transmitteraffected
ElectrolinkCompact FM Transmitter500Waffected
ElectrolinkCompact FM Transmitter1kWaffected
ElectrolinkCompact FM Transmitter2kWaffected
ElectrolinkModular FM Transmitter3kWaffected
ElectrolinkModular FM Transmitter5kWaffected
ElectrolinkModular FM Transmitter10kWaffected
ElectrolinkModular FM Transmitter15kWaffected
ElectrolinkModular FM Transmitter20kWaffected
ElectrolinkModular FM Transmitter30kWaffected
ElectrolinkDigital FM Transmitter15W <= 40kWaffected
ElectrolinkVHF TV TransmitterBIaffected
ElectrolinkVHF TV TransmitterBIIIaffected
ElectrolinkUHF TV Transmitter10W <= 5kWaffected

Weaknesses

  • CWE-312: CWE-312 Cleartext Storage of Sensitive Information

Workarounds

Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink https://electrolink.com/contacts/ for additional information.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References