Skip to content
Fencer Vulns
high 7.5

CVE-2024-1491 json

Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

published 2024-04-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-17239

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-107-02 updated cvss 7.5

Electrolink FM/DAB/TV Transmitter

  • Electrolink 1kW Compact FM Transmitter Electrolink 1kW Medium DAB Transmitter Electrolink 2.5kW High Power DAB Transmitter Electrolink 2kW Compact FM Transmitter Electrolink 2kW Medium DAB Transmitter Electrolink 3kW High Power DAB Transmitter
    +18 more products
    Electrolink 3kW Modular FM Transmitter Electrolink 4kW High Power DAB Transmitter Electrolink 5kW High Power DAB Transmitter Electrolink 5kW Modular FM Transmitter Electrolink 10kW Modular FM Transmitter Electrolink 10W - 5kW UHF TV Transmitter Electrolink 10W Compact DAB Transmitter Electrolink 15kW Modular FM Transmitter Electrolink 15W - 40kW Digital FM Transmitter Electrolink 20kW Modular FM Transmitter Electrolink 30kW Modular FM Transmitter Electrolink 100W Compact DAB Transmitter Electrolink 100W Compact FM Transmitter Electrolink 250W Compact DAB Transmitter Electrolink 500W Compact FM Transmitter Electrolink 500W Medium DAB Transmitter Electrolink BI VHF TV Transmitter Electrolink BIII VHF TV Transmitter
    affected: mitigation “Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink for additional information.” electrolink.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Electrolink Compact DAB Transmitter
  • Electrolink Medium DAB Transmitter
  • Electrolink High Power DAB Transmitter
  • Electrolink Compact FM Transmitter
  • Electrolink Modular FM Transmitter
  • Electrolink Digital FM Transmitter
  • Electrolink VHF TV Transmitter
  • Electrolink UHF TV Transmitter
  • 0xacab mat2

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.