Electrolink Compact DAB Transmitter Login Cookie authentication bypass by assumed-immutable data
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
9.5 | $0-$5k | 0.00 |
A vulnerability has been found in Electrolink Compact DAB Transmitter, Medium DAB Transmitter, High Power DAB Transmitter, Compact FM Transmitter, Modular FM Transmitter, Digital FM Transmitter, VHF TV Transmitter and UHF TV Transmitter and classified as very critical. This vulnerability affects an unknown functionality of the component Login Cookie Handler. The manipulation with an unknown input leads to a authentication bypass by assumed-immutable data vulnerability. The CWE definition for the vulnerability is CWE-302. The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker. As an impact it is known to affect confidentiality, integrity, and availability.
The advisory is shared for download at cisa.gov. This vulnerability was named CVE-2024-3741. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/16/2024).
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
Product
Vendor
Name
- Compact DAB Transmitter
- Compact FM Transmitter
- Digital FM Transmitter
- High Power DAB Transmitter
- Medium DAB Transmitter
- Modular FM Transmitter
- UHF TV Transmitter
- VHF TV Transmitter
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔒VulDB CVSS-BT Score: 🔒
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 9.8VulDB Meta Temp Score: 9.5
VulDB Base Score: 9.8
VulDB Temp Score: 9.5
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Authentication bypass by assumed-immutable dataCWE: CWE-302
CAPEC: 🔒
ATT&CK: 🔒
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔒
Timeline
04/16/2024 Advisory disclosed04/16/2024 VulDB entry created
04/16/2024 VulDB entry last update
Sources
Advisory: icsa-24-107-02Status: Not defined
CVE: CVE-2024-3741 (🔒)
Entry
Created: 04/16/2024 21:20Changes: 04/16/2024 21:20 (49)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.