{"id":"CVE-2024-22179","state":"PUBLISHED","title":"Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data","description":"The application is vulnerable to an unauthenticated parameter \nmanipulation that allows an attacker to set the credentials to blank \ngiving her access to the admin panel. Also vulnerable to account \ntakeover and arbitrary password change.","publishedAt":"2024-04-18T22:06:26.781Z","updatedAt":"2024-08-01T22:35:34.937Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Electrolink Compact DAB Transmitter","Electrolink Medium DAB Transmitter","Electrolink High Power DAB Transmitter","Electrolink Compact FM Transmitter","Electrolink Modular FM Transmitter","Electrolink Digital FM Transmitter","Electrolink VHF TV Transmitter","Electrolink UHF TV Transmitter"],"affected":[{"vendor":"Electrolink","product":"Compact DAB Transmitter","defaultStatus":"unaffected","versions":[{"version":"10W","status":"affected"},{"version":"100W","status":"affected"},{"version":"250W","status":"affected"}]},{"vendor":"Electrolink","product":"Medium DAB Transmitter","defaultStatus":"unaffected","versions":[{"version":"500W","status":"affected"},{"version":"1kW","status":"affected"},{"version":"2kW","status":"affected"}]},{"vendor":"Electrolink","product":"High Power DAB Transmitter","defaultStatus":"unaffected","versions":[{"version":"2.5kW","status":"affected"},{"version":"3kW","status":"affected"},{"version":"4kW","status":"affected"},{"version":"5kW","status":"affected"}]},{"vendor":"Electrolink","product":"Compact FM Transmitter","defaultStatus":"unaffected","versions":[{"version":"Compact FM Transmitter","status":"affected"},{"version":"500W","status":"affected"},{"version":"1kW","status":"affected"},{"version":"2kW","status":"affected"}]},{"vendor":"Electrolink","product":"Modular FM Transmitter","defaultStatus":"unaffected","versions":[{"version":"3kW","status":"affected"},{"version":"5kW","status":"affected"},{"version":"10kW","status":"affected"},{"version":"15kW","status":"affected"},{"version":"20kW","status":"affected"},{"version":"30kW","status":"affected"}]},{"vendor":"Electrolink","product":"Digital FM Transmitter","defaultStatus":"unaffected","versions":[{"version":"15W","status":"affected","lessThanOrEqual":"40kW","versionType":"custom"}]},{"vendor":"Electrolink","product":"VHF TV Transmitter","defaultStatus":"unaffected","versions":[{"version":"BI","status":"affected"},{"version":"BIII","status":"affected"}]},{"vendor":"Electrolink","product":"UHF TV Transmitter","defaultStatus":"unaffected","versions":[{"version":"10W","status":"affected","lessThanOrEqual":"5kW","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"],"weaknesses":["CWE-302"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/22xxx/CVE-2024-22179.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-22179","state":"PUBLISHED","datePublished":"2024-04-18T22:06:26.781Z","dateUpdated":"2024-08-01T22:35:34.937Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-01-05T22:07:42.998Z"},"containers":{"cna":{"title":"Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data","descriptions":[{"lang":"en","value":"The application is vulnerable to an unauthenticated parameter \nmanipulation that allows an attacker to set the credentials to blank \ngiving her access to the admin panel. Also vulnerable to account \ntakeover and arbitrary password change."}],"affected":[{"vendor":"Electrolink","product":"Compact DAB Transmitter","defaultStatus":"unaffected","versions":[{"version":"10W","status":"affected"},{"version":"100W","status":"affected"},{"version":"250W","status":"affected"}]},{"vendor":"Electrolink","product":"Medium DAB Transmitter","defaultStatus":"unaffected","versions":[{"version":"500W","status":"affected"},{"version":"1kW","status":"affected"},{"version":"2kW","status":"affected"}]},{"vendor":"Electrolink","product":"High Power DAB Transmitter","defaultStatus":"unaffected","versions":[{"version":"2.5kW","status":"affected"},{"version":"3kW","status":"affected"},{"version":"4kW","status":"affected"},{"version":"5kW","status":"affected"}]},{"vendor":"Electrolink","product":"Compact FM Transmitter","defaultStatus":"unaffected","versions":[{"version":"Compact FM Transmitter","status":"affected"},{"version":"500W","status":"affected"},{"version":"1kW","status":"affected"},{"version":"2kW","status":"affected"}]},{"vendor":"Electrolink","product":"Modular FM Transmitter","defaultStatus":"unaffected","versions":[{"version":"3kW","status":"affected"},{"version":"5kW","status":"affected"},{"version":"10kW","status":"affected"},{"version":"15kW","status":"affected"},{"version":"20kW","status":"affected"},{"version":"30kW","status":"affected"}]},{"vendor":"Electrolink","product":"Digital FM Transmitter","defaultStatus":"unaffected","versions":[{"version":"15W","status":"affected","lessThanOrEqual":"40kW","versionType":"custom"}]},{"vendor":"Electrolink","product":"VHF TV Transmitter","defaultStatus":"unaffected","versions":[{"version":"BI","status":"affected"},{"version":"BIII","status":"affected"}]},{"vendor":"Electrolink","product":"UHF TV Transmitter","defaultStatus":"unaffected","versions":[{"version":"10W","status":"affected","lessThanOrEqual":"5kW","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-302","description":"CWE-302","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-05-28T16:45:02.057Z"},"credits":[{"lang":"en","type":"finder","value":"Gjoko Krstic publicly reported these vulnerabilities on the internet after an unsuccessful attempt to contact Electrolink directly."}],"source":{"advisory":"ICSA-24-107-02","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Electrolink has not responded to requests to work with CISA to mitigate \nthese vulnerabilities. Users of the affected products are encouraged to \ncontact <a target=\"_blank\" rel=\"nofollow\" href=\"https://electrolink.com/contacts/\">Electrolink</a> for additional information.\n\n<br>"}],"value":"Electrolink has not responded to requests to work with CISA to mitigate \nthese vulnerabilities. Users of the affected products are encouraged to \ncontact  Electrolink https://electrolink.com/contacts/  for additional information."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"electrolink","product":"compact dab transmitter","defaultStatus":"unknown","versions":[{"version":"10w","status":"affected"},{"version":"100w","status":"affected"},{"version":"250w","status":"affected"}],"cpes":["cpe:2.3:a:electrolink:compact_dab_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"medium dab transmitter","defaultStatus":"unknown","versions":[{"version":"500w","status":"affected"},{"version":"1kw","status":"affected"},{"version":"2kw","status":"affected"}],"cpes":["cpe:2.3:a:electrolink:medium_dab_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"high power dab transmitter","defaultStatus":"unknown","versions":[{"version":"2.5kw","status":"affected"},{"version":"3kw","status":"affected"},{"version":"4kw","status":"affected"},{"version":"5kw","status":"affected"}],"cpes":["cpe:2.3:a:electrolink:high_power_dab_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"compact fm transmitter","defaultStatus":"unknown","versions":[{"version":"500w","status":"affected"},{"version":"1kw","status":"affected"},{"version":"2kw","status":"affected"}],"cpes":["cpe:2.3:a:electrolink:compact_fm_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"modular fm transmitter","defaultStatus":"unknown","versions":[{"version":"3kw","status":"affected"},{"version":"5kw","status":"affected"},{"version":"10kw","status":"affected"},{"version":"15kw","status":"affected"},{"version":"20kw","status":"affected"},{"version":"30kw","status":"affected"}],"cpes":["cpe:2.3:a:electrolink:modular_fm_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"digital fm transmitter","defaultStatus":"unknown","versions":[{"version":"15w","status":"affected","lessThanOrEqual":"40kw","versionType":"custom"}],"cpes":["cpe:2.3:a:electrolink:digital_fm_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"vhf tv transmitter","defaultStatus":"unknown","versions":[{"version":"bi","status":"affected"},{"version":"biii","status":"affected"}],"cpes":["cpe:2.3:a:electrolink:vhf_tv_transmitter:*:*:*:*:*:*:*:*"]},{"vendor":"electrolink","product":"uhf tv transmitter","defaultStatus":"unknown","versions":[{"version":"10w","status":"affected","lessThanOrEqual":"5kw","versionType":"custom"}],"cpes":["cpe:2.3:a:electrolink:uhf_tv_transmitter:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-16T14:46:38.775197Z","id":"CVE-2024-22179","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-16T15:05:06.230Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T22:35:34.937Z"}}]}}}