Read the docs
TI-2024-01393 Aliases CVE-2024-1491GHSA-xww2-7grc-g9mp

Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

Priority MEDIUM 40CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElectrolinkCompact DAB Transmitter10W; 100W; 250W—No fix listedCNA
ElectrolinkMedium DAB Transmitter500W; 1kW; 2kW—No fix listedCNA
ElectrolinkHigh Power DAB Transmitter2.5kW; 3kW; 4kW; 5kW—No fix listedCNA
ElectrolinkCompact FM TransmitterCompact FM Transmitter; 500W; 1kW; 2kW—No fix listedCNA
ElectrolinkModular FM Transmitter3kW; 5kW; 10kW; 15kW; 20kW; 30kW—No fix listedCNA
ElectrolinkDigital FM Transmitter15W – 40kW—No fix listedCNA
ElectrolinkVHF TV TransmitterBI; BIII—No fix listedCNA
ElectrolinkUHF TV Transmitter10W – 5kW—No fix listedCNA
  • Compact DAB Transmitter VendorElectrolink Affected 10W; 100W; 250W Fixed in — No fix listed CNA
  • Medium DAB Transmitter VendorElectrolink Affected 500W; 1kW; 2kW Fixed in — No fix listed CNA
  • High Power DAB Transmitter VendorElectrolink Affected 2.5kW; 3kW; 4kW; 5kW Fixed in — No fix listed CNA
  • Compact FM Transmitter VendorElectrolink Affected Compact FM Transmitter; 500W; 1kW; 2kW Fixed in — No fix listed CNA
  • Modular FM Transmitter VendorElectrolink Affected 3kW; 5kW; 10kW; 15kW; 20kW; 30kW Fixed in — No fix listed CNA
  • Digital FM Transmitter VendorElectrolink Affected 15W – 40kW Fixed in — No fix listed CNA
  • VHF TV Transmitter VendorElectrolink Affected BI; BIII Fixed in — No fix listed CNA
  • UHF TV Transmitter VendorElectrolink Affected 10W – 5kW Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:0xacab:mat2:0.10.0:*:*:*:*:*:*:*0.10.0—0xacab
  • cpe:2.3:a:0xacab:mat2:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 — ·0xacab

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1491
  2. 2026-10-03 Alias added: GHSA-xww2-7grc-g9mp

References

Other 1

  • TI-2025-20751 A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter… CVSS 3.1HIGH 7.5
  • TI-2025-32294 Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability… CVSS 3.1HIGH 7.5
  • TI-2024-03488 Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information CVSS 4.0HIGH 8.7
  • TI-2024-14773 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data CVSS 4.0HIGH 8.7
  • TI-2024-14539 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking CVSS 4.0HIGH 8.7
  • TI-2024-03487 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data CVSS 4.0HIGH 8.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences