CVE-2024-3741 - Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data

Back Back to CVE browser

HIGH

Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data

Published Apr 18, 2024

8.7

HIGH

CVSS 4.0

EPSS 0.49%

Description

Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access.

Affected products

Vendor Electrolink Product Compact DAB Transmitter Default
unaffected
Affected
- 100W
- 10W
- 250W
Vendor Electrolink Product Compact FM Transmitter Default
unaffected
Affected
- 1kW
- 2kW
- 500W
- Compact FM Transmitter
Vendor Electrolink Product Digital FM Transmitter Default
unaffected
Affected
- ≥ 15W, ≤ 40kW
Vendor Electrolink Product High Power DAB Transmitter Default
unaffected
Affected
- 2.5kW
- 3kW
- 4kW
- 5kW
Vendor Electrolink Product Medium DAB Transmitter Default
unaffected
Affected
- 1kW
- 2kW
- 500W
Vendor Electrolink Product Modular FM Transmitter Default
unaffected
Affected
- 10kW
- 15kW
- 20kW
- 30kW
- 3kW
- 5kW
Vendor Electrolink Product UHF TV Transmitter Default
unaffected
Affected
- ≥ 10W, ≤ 5kW
Vendor Electrolink Product VHF TV Transmitter Default
unaffected
Affected
- BI
- BIII

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Electrolink	Compact DAB Transmitter	unaffected	Affected 100W 10W 250W
Electrolink	Compact FM Transmitter	unaffected	Affected 1kW 2kW 500W Compact FM Transmitter
Electrolink	Digital FM Transmitter	unaffected	Affected ≥ 15W, ≤ 40kW
Electrolink	High Power DAB Transmitter	unaffected	Affected 2.5kW 3kW 4kW 5kW
Electrolink	Medium DAB Transmitter	unaffected	Affected 1kW 2kW 500W
Electrolink	Modular FM Transmitter	unaffected	Affected 10kW 15kW 20kW 30kW 3kW 5kW
Electrolink	UHF TV Transmitter	unaffected	Affected ≥ 10W, ≤ 5kW
Electrolink	VHF TV Transmitter	unaffected	Affected BI BIII

Vendor Electrolink Product Compact Dab Transmitter Default
unknown
Affected
- 250W
Vendor Electrolink Product Compact FM Transmitter Default
unknown
Affected
- 2kW
Vendor Electrolink Product Digital FM Transmitter Default
unknown
Affected
- 15W
Vendor Electrolink Product High Power Dab Transmitter Default
unknown
Affected
- 5kW
Vendor Electrolink Product Medium Dab Transmitter Default
unknown
Affected
- 2kW
Vendor Electrolink Product Modular FM Transmitter Default
unknown
Affected
- 30kW
Vendor Electrolink Product Uhf TV Transmitter Default
unknown
Affected
- 10W
Vendor Electrolink Product Vhf TV Transmitter Default
unknown
Affected
- BI

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Electrolink	Compact Dab Transmitter	unknown	Affected 250W
Electrolink	Compact FM Transmitter	unknown	Affected 2kW
Electrolink	Digital FM Transmitter	unknown	Affected 15W
Electrolink	High Power Dab Transmitter	unknown	Affected 5kW
Electrolink	Medium Dab Transmitter	unknown	Affected 2kW
Electrolink	Modular FM Transmitter	unknown	Affected 30kW
Electrolink	Uhf TV Transmitter	unknown	Affected 10W
Electrolink	Vhf TV Transmitter	unknown	Affected BI

Remediation

Vendor solution

Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink https://electrolink.com/contacts/ for additional information.

Weaknesses (1)

CWE-302