CVE-2024-1491
Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.
Timeline
ID reserved
By icscert
- 2 months later
· 2 months later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| icscertCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVDNVD · Deferred | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.55% · top 54% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Weakness
Affected products
Electrolink · Compact DAB Transmitter
- affected 10W
- affected 100W
- affected 250W
Electrolink · Medium DAB Transmitter
- affected 500W
- affected 1kW
- affected 2kW
Electrolink · High Power DAB Transmitter
- affected 2.5kW
- affected 3kW
- affected 4kW
- affected 5kW
Electrolink · Compact FM Transmitter
- affected Compact FM Transmitter
- affected 500W
- affected 1kW
- affected 2kW
Electrolink · Modular FM Transmitter
- affected 3kW
- affected 5kW
- affected 10kW
- affected 15kW
- affected 20kW
- affected 30kW
Electrolink · Digital FM Transmitter
- affected 15W – ≤ 40kW
Electrolink · VHF TV Transmitter
- affected BI
- affected BIII
Electrolink · UHF TV Transmitter
- affected 10W – ≤ 5kW
What to do
Workaround: Electrolink has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Electrolink https://electrolink.com/contacts/ for additional information.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-1491)Record last updated .