CVE-2024-22186
Assigner: icscert
Published: 2024-04-18T22:08:17.798Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Compact DAB Transmitter
vendor: Electrolink 
versions: status: affected
version: 10W
status: affected
version: 100W
status: affected
version: 250W
defaultStatus: unaffected
product: Medium DAB Transmitter
vendor: Electrolink 
versions: status: affected
version: 500W
status: affected
version: 1kW
status: affected
version: 2kW
defaultStatus: unaffected
product: High Power DAB Transmitter
vendor: Electrolink 
versions: status: affected
version: 2.5kW
status: affected
version: 3kW
status: affected
version: 4kW
status: affected
version: 5kW 
defaultStatus: unaffected
product: Compact FM Transmitter
vendor: Electrolink 
versions: status: affected
version: Compact FM Transmitter
status: affected
version: 500W
status: affected
version: 1kW
status: affected
version: 2kW 
defaultStatus: unaffected
product: Modular FM Transmitter
vendor: Electrolink 
versions: status: affected
version: 3kW
status: affected
version: 5kW
status: affected
version: 10kW
status: affected
version: 15kW
status: affected
version: 20kW
status: affected
version: 30kW 
defaultStatus: unaffected
product: Digital FM Transmitter
vendor: Electrolink 
versions: lessThanOrEqual: 40kW 
status: affected
version: 15W 
versionType: custom
defaultStatus: unaffected
product: VHF TV Transmitter
vendor: Electrolink 
versions: status: affected
version: BI
status: affected
version: BIII 
defaultStatus: unaffected
product: UHF TV Transmitter
vendor: Electrolink 
versions: lessThanOrEqual: 5kW 
status: affected
version: 10W 
versionType: custom
credits: type: finder
value: Gjoko Krstic publicly reported these vulnerabilities on the internet after an unsuccessful attempt to contact Electrolink directly.
descriptions: supportingMedia: base64: no
type: text/html
value: 


The application suffers from a privilege escalation vulnerability. An 
attacker logged in as guest can escalate his privileges by poisoning the
 cookie to become administrator.


value: 
The application suffers from a privilege escalation vulnerability. An 
attacker logged in as guest can escalate his privileges by poisoning the
 cookie to become administrator.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-565
description: CWE-565 Reliance on Cookies without Validation and Integrity Checking
type: CWE
source: advisory: ICSA-24-107-02
discovery: EXTERNAL
title: Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking
workarounds: supportingMedia: base64: no
type: text/html
value: 
Electrolink has not responded to requests to work with CISA to mitigate 
these vulnerabilities. Users of the affected products are encouraged to 
contact <a target="_blank" rel="nofollow" href="https://electrolink.com/contacts/">Electrolink</a> for additional information.

<br>
value: Electrolink has not responded to requests to work with CISA to mitigate 
these vulnerabilities. Users of the affected products are encouraged to 
contact  Electrolink https://electrolink.com/contacts/  for additional information.


x_generator: engine: Vulnogram 0.1.0-dev