What’s Vulnerable › Vulnerabilities

CVE-2024-21846: Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-18 · updated 2026-06-17
• Weakness: CWE-306

Description

An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resulting in a denial-of-service scenario.

Affected products

• Electrolink Compact DAB Transmitter: 10w, 100w, 250w
• Electrolink Compact FM Transmitter: 500w, 1kw, 2kw
• Electrolink Digital FM Transmitter: from 15w through 40kw
• Electrolink High Power DAB Transmitter: 2.5kw, 3kw, 4kw, 5kw
• Electrolink Medium DAB Transmitter: 500w, 1kw, 2kw
• Electrolink Modular FM Transmitter: 3kw, 5kw, 10kw, 15kw, 20kw, 30kw
• Electrolink UHF TV Transmitter: from 10w through 5kw
• Electrolink VHF TV Transmitter: bi, biii

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02

Get alerted when CVE-2024-21846 or the next vulnerability affects your stack