Reliance on Cookies without Validation and Integrity Checking in Electrolink products - CVE-2024-21872

Vulnerability identifier: #VU88760

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-21872

CWE-ID: CWE-565

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to reliance on cookies without validation and integrity checking. A remote attacker can bypass authentication and modify the cookie to reveal hidden pages.

1kW Compact FM Transmitter
10W - 5kW UHF TV Transmitter
BIII VHF TV Transmitter
BI VHF TV Transmitter
15W - 40kW Digital FM Transmitter
30kW Modular FM Transmitter
20kW Modular FM Transmitter
15kW Modular FM Transmitter
10kW Modular FM Transmitter
5kW Modular FM Transmitter
3kW Modular FM Transmitter
2kW Compact FM Transmitter
10W Compact DAB Transmitter
500W Compact FM Transmitter
100W Compact FM Transmitter
5kW High Power DAB Transmitter
4kW High Power DAB Transmitter
3kW High Power DAB Transmitter
2.5kW High Power DAB Transmitter
2kW Medium DAB Transmitter
1kW Medium DAB Transmitter
500W Medium DAB Transmitter
250W Compact DAB Transmitter
100W Compact DAB Transmitter

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02

• Multiple vulnerabilities in Electrolink FM/DAB/TV Transmitter