Lucene search

K
vulnrichmentIcscertVULNRICHMENT:CVE-2024-21872
HistoryApr 18, 2024 - 10:10 p.m.

CVE-2024-21872 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

2024-04-1822:10:42
CWE-565
icscert
github.com
3
electrolink
transmitter
unauthorized access
cookie validation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

7.3

Confidence

Low

EPSS

0

Percentile

9.0%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

The device allows an unauthenticated attacker to bypass authentication
and modify the cookie to reveal hidden pages that allows more critical
operations to the transmitter.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:electrolink:high_power_dab_transmitter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "electrolink",
    "product": "high power dab transmitter",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:electrolink:compact_dab_transmitter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "electrolink",
    "product": "compact dab transmitter",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:electrolink:modular_fm_transmitter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "electrolink",
    "product": "modular fm transmitter",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:electrolink:compact_fm_transmitter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "electrolink",
    "product": "compact fm transmitter",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:electrolink:digital_fm_transmitter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "electrolink",
    "product": "digital fm transmitter",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:electrolink:vhf_tv_transmitter:*:*:*:*:*:*:*:*"
    ],
    "vendor": "electrolink",
    "product": "vhf tv transmitter",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  }
]

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

7.3

Confidence

Low

EPSS

0

Percentile

9.0%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

Related for VULNRICHMENT:CVE-2024-21872