PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-22179 Electrolink CVE debrief

CVE-2024-22179 is a HIGH severity authentication bypass vulnerability affecting Electrolink FM/DAB/TV transmitters, published by CISA on April 16, 2024. The vulnerability allows unauthenticated attackers to manipulate parameters to blank administrative credentials, enabling unauthorized access to the admin panel. The same flaw also permits account takeover and arbitrary password changes. The CVSS 3.1 score of 7.5 reflects network-based attackability with low complexity and no privileges required, with high impact to integrity. Notably, Electrolink has not responded to CISA's coordination efforts, leaving affected users without vendor-provided patches. The scope encompasses 24 transmitter models across DAB, FM, and TV product lines, all versions affected.

Vendor
Electrolink
Product
10W Compact DAB Transmitter
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-16
Original CVE updated
2024-04-16
Advisory published
2024-04-16
Advisory updated
2024-04-16

Who should care

Broadcast operators, critical infrastructure defenders, and media organizations using Electrolink transmission equipment should prioritize assessment. The unauthenticated exploitation path and admin panel access pose risks to broadcast integrity and availability. Organizations with internet-exposed transmitter management interfaces face elevated risk.

Technical summary

The Electrolink transmitter management application fails to properly validate authentication state before processing credential modification requests. An unauthenticated attacker can manipulate request parameters to set administrative credentials to blank values, achieving immediate unauthorized access to the administrative panel. The same underlying weakness enables account takeover through arbitrary password changes for existing accounts. The vulnerability is network-exploitable without authentication, affecting all versions of 24 transmitter models spanning DAB, FM, and TV broadcast equipment.

Defensive priority

HIGH

Recommended defensive actions

  • Contact Electrolink directly for security updates or mitigation guidance, as the vendor has not coordinated with CISA
  • Implement network segmentation to isolate affected transmitters from untrusted networks
  • Restrict management interface access to dedicated, monitored administrative networks only
  • Monitor for unauthorized configuration changes or unexpected admin panel access attempts
  • Apply CISA ICS recommended practices for defense-in-depth strategies
  • Review and strengthen authentication mechanisms on any exposed management interfaces

Evidence notes

CISA advisory ICSA-24-107-02 documents unauthenticated parameter manipulation enabling credential blanking, admin panel access, account takeover, and arbitrary password change. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N confirms network-exploitable, unauthenticated integrity impact. Affected product list derived from CSAF product tree with 24 confirmed product IDs.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-22179 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-22179

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-22179 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-22179

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-107-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.