Skip to content
Fencer Vulns
medium 5.3

CVE-2024-21846 json

Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

published 2024-04-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-19458

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resulting in a denial-of-service scenario.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-107-02 updated cvss 5.3

Electrolink FM/DAB/TV Transmitter

  • Electrolink 1kW Compact FM Transmitter Electrolink 1kW Medium DAB Transmitter Electrolink 2.5kW High Power DAB Transmitter Electrolink 2kW Compact FM Transmitter Electrolink 2kW Medium DAB Transmitter Electrolink 3kW High Power DAB Transmitter
    +18 more products
    Electrolink 3kW Modular FM Transmitter Electrolink 4kW High Power DAB Transmitter Electrolink 5kW High Power DAB Transmitter Electrolink 5kW Modular FM Transmitter Electrolink 10kW Modular FM Transmitter Electrolink 10W - 5kW UHF TV Transmitter Electrolink 10W Compact DAB Transmitter Electrolink 15kW Modular FM Transmitter Electrolink 15W - 40kW Digital FM Transmitter Electrolink 20kW Modular FM Transmitter Electrolink 30kW Modular FM Transmitter Electrolink 100W Compact DAB Transmitter Electrolink 100W Compact FM Transmitter Electrolink 250W Compact DAB Transmitter Electrolink 500W Compact FM Transmitter Electrolink 500W Medium DAB Transmitter Electrolink BI VHF TV Transmitter Electrolink BIII VHF TV Transmitter
    affected: mitigation “Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink for additional information.” electrolink.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Electrolink Compact DAB Transmitter
  • Electrolink Medium DAB Transmitter
  • Electrolink High Power DAB Transmitter
  • Electrolink Compact FM Transmitter
  • Electrolink Modular FM Transmitter
  • Electrolink Digital FM Transmitter
  • Electrolink VHF TV Transmitter
  • Electrolink UHF TV Transmitter

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.