Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
Priority MEDIUM 44CWE-302Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full system access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00492 42nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Electrolink | Compact DAB Transmitter | 10W; 100W; 250W | — | No fix listed | CNA |
| Electrolink | Medium DAB Transmitter | 500W; 1kW; 2kW | — | No fix listed | CNA |
| Electrolink | High Power DAB Transmitter | 2.5kW; 3kW; 4kW; 5kW | — | No fix listed | CNA |
| Electrolink | Compact FM Transmitter | Compact FM Transmitter; 500W; 1kW; 2kW | — | No fix listed | CNA |
| Electrolink | Modular FM Transmitter | 3kW; 5kW; 10kW; 15kW; 20kW; 30kW | — | No fix listed | CNA |
| Electrolink | Digital FM Transmitter | 15W – 40kW | — | No fix listed | CNA |
| Electrolink | VHF TV Transmitter | BI; BIII | — | No fix listed | CNA |
| Electrolink | UHF TV Transmitter | 10W – 5kW | — | No fix listed | CNA |
- Compact DAB Transmitter VendorElectrolink Affected 10W; 100W; 250W Fixed in — No fix listed CNA
- Medium DAB Transmitter VendorElectrolink Affected 500W; 1kW; 2kW Fixed in — No fix listed CNA
- High Power DAB Transmitter VendorElectrolink Affected 2.5kW; 3kW; 4kW; 5kW Fixed in — No fix listed CNA
- Compact FM Transmitter VendorElectrolink Affected Compact FM Transmitter; 500W; 1kW; 2kW Fixed in — No fix listed CNA
- Modular FM Transmitter VendorElectrolink Affected 3kW; 5kW; 10kW; 15kW; 20kW; 30kW Fixed in — No fix listed CNA
- Digital FM Transmitter VendorElectrolink Affected 15W – 40kW Fixed in — No fix listed CNA
- VHF TV Transmitter VendorElectrolink Affected BI; BIII Fixed in — No fix listed CNA
- UHF TV Transmitter VendorElectrolink Affected 10W – 5kW Fixed in — No fix listed CNA
CPE names CISA-ADP · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:electrolink:medium_dab_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:uhf_tv_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:high_power_dab_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:compact_dab_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:compact_fm_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:modular_fm_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:digital_fm_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
| cpe:2.3:a:electrolink:vhf_tv_transmitter:*:*:*:*:*:*:*:* | — | — | Electrolink |
- cpe:2.3:a:electrolink:medium_dab_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:uhf_tv_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:high_power_dab_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:compact_dab_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:compact_fm_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:modular_fm_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:digital_fm_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
- cpe:2.3:a:electrolink:vhf_tv_transmitter:*:*:*:*:*:*:*:* Versions — — ·Electrolink
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3741
- 2026-10-03 Alias added: GHSA-hhcp-6v36-gh75
References
More Electrolink vulnerabilities
- TI-2025-20751 A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter… CVSS 3.1HIGH 7.5
- TI-2025-32294 Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability… CVSS 3.1HIGH 7.5
- TI-2024-03488 Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information CVSS 4.0HIGH 8.7
- TI-2024-14773 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data CVSS 4.0HIGH 8.7
- TI-2024-14539 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking CVSS 4.0HIGH 8.7
- TI-2024-14779 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking CVSS 4.0HIGH 8.7
Sources
- CVE-2024-3741 · CVE Program
- CVE-2024-3741 · NVD
- FIRST EPSS
- GHSA-hhcp-6v36-gh75 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences