CVSS: 8.7EPSS: 0%CPEs: 22EXPL: 0CVE-2024-3742 – Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information
https://notcve.org/view.php?id=CVE-2024-3742
Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system. Los transmisores Electrolink almacenan las credenciales en texto claro. El uso de estas credenciales podría permitir que un atacante acceda al sistema. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.7EPSS: 0%CPEs: 22EXPL: 0CVE-2024-1491 – Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function
https://notcve.org/view.php?id=CVE-2024-1491
The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code. Los dispositivos permiten el acceso a un punto final desprotegido que permite la carga de imágenes binarias del sistema de archivos MPFS sin autenticación. El módulo de sistema de archivos MPFS2 proporciona un sistema de archivos liviano de solo lectura que se puede almacenar en una EEPROM externa, una memoria flash serial externa o una memoria flash interna de programa. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.9EPSS: 0%CPEs: 22EXPL: 0CVE-2024-21846 – Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function
https://notcve.org/view.php?id=CVE-2024-21846
An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resulting in a denial-of-service scenario. Un atacante no autenticado puede restablecer la placa y detener las operaciones del transmisor enviando una solicitud GET especialmente manipulada a la puerta de enlace command.cgi, lo que resulta en un escenario de denegación de servicio. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.7EPSS: 0%CPEs: 22EXPL: 0CVE-2024-21872 – Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking
https://notcve.org/view.php?id=CVE-2024-21872
The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter. El dispositivo permite a un atacante no autenticado eludir la autenticación y modificar la cookie para revelar páginas ocultas que permiten operaciones más críticas para el transmisor. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 8.8EPSS: 0%CPEs: 22EXPL: 0CVE-2024-22186 – Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking
https://notcve.org/view.php?id=CVE-2024-22186
The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator. La aplicación sufre una vulnerabilidad de escalada de privilegios. Un atacante que haya iniciado sesión como invitado puede aumentar sus privilegios envenenando la cookie para convertirse en administrador. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •