Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-1491— Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

CVSS 7.5 · High EPSS 0.14% · P34
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-1491

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function
Source: NVD (National Vulnerability Database)
Vulnerability Description
The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Electrolink FM/DAB/TV Transmitter 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Electrolink FM/DAB/TV Transmitter是Electrolink公司的一系列发射机。 Electrolink FM/DAB/TV Transmitter 存在访问控制错误漏洞，该漏洞源于允许攻击者访问未受保护的终结点，并在没有身份验证的情况下通过MPFS文件系统上传二进制映像。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
ElectrolinkCompact DAB Transmitter 10W -
ElectrolinkMedium DAB Transmitter 500W -
ElectrolinkHigh Power DAB Transmitter 2.5kW -
ElectrolinkCompact FM Transmitter Compact FM Transmitter -
ElectrolinkModular FM Transmitter 3kW -
ElectrolinkDigital FM Transmitter 15W ~ 40kW -
ElectrolinkVHF TV Transmitter BI -
ElectrolinkUHF TV Transmitter 10W ~ 5kW -

II. Public POCs for CVE-2024-1491

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-1491

请登录查看更多情报信息。

Same Patch Batch · Electrolink · 2024-04-18 · 7 CVEs total

CVE-2024-221868.8 HIGHElectrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Che
CVE-2024-218727.5 HIGHElectrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Che
CVE-2024-221797.5 HIGHElectrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
CVE-2024-37417.5 HIGHElectrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
CVE-2024-37427.5 HIGHElectrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information
CVE-2024-218465.3 MEDIUMElectrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

IV. Related Vulnerabilities

Same product: Compact DAB Transmitter
Same vendor: Electrolink
Same weakness: CWE-306

V. Comments for CVE-2024-1491

No comments yet

Leave a comment