Skip to content
Fencer Vulns
high 8.8

CVE-2024-22186 json

Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

published 2024-04-18 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-19782

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-107-02 updated cvss 8.8

Electrolink FM/DAB/TV Transmitter

  • Electrolink 1kW Compact FM Transmitter Electrolink 1kW Medium DAB Transmitter Electrolink 2.5kW High Power DAB Transmitter Electrolink 2kW Compact FM Transmitter Electrolink 2kW Medium DAB Transmitter Electrolink 3kW High Power DAB Transmitter
    +18 more products
    Electrolink 3kW Modular FM Transmitter Electrolink 4kW High Power DAB Transmitter Electrolink 5kW High Power DAB Transmitter Electrolink 5kW Modular FM Transmitter Electrolink 10kW Modular FM Transmitter Electrolink 10W - 5kW UHF TV Transmitter Electrolink 10W Compact DAB Transmitter Electrolink 15kW Modular FM Transmitter Electrolink 15W - 40kW Digital FM Transmitter Electrolink 20kW Modular FM Transmitter Electrolink 30kW Modular FM Transmitter Electrolink 100W Compact DAB Transmitter Electrolink 100W Compact FM Transmitter Electrolink 250W Compact DAB Transmitter Electrolink 500W Compact FM Transmitter Electrolink 500W Medium DAB Transmitter Electrolink BI VHF TV Transmitter Electrolink BIII VHF TV Transmitter
    affected: mitigation “Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink for additional information.” electrolink.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Electrolink Compact DAB Transmitter
  • Electrolink Medium DAB Transmitter
  • Electrolink High Power DAB Transmitter
  • Electrolink Compact FM Transmitter
  • Electrolink Modular FM Transmitter
  • Electrolink Digital FM Transmitter
  • Electrolink VHF TV Transmitter
  • Electrolink UHF TV Transmitter

Classification

Weakness
  • CWE-565 Reliance on Cookies without Validation and Integrity Checking

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.