Electrolink FM/DAB/TV Transmitter
Plan Patch8.8ICS-CERT ICSA-24-107-02Apr 16, 2024
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Multiple vulnerabilities in Electrolink FM/DAB/TV transmitters (CWE-302, CWE-565, CWE-306, CWE-312) allow an authenticated attacker with network access to obtain full system access, execute arbitrary code, escalate privileges, modify credentials, and prevent the device from transmitting. Affected products include compact, modular, and high-power DAB transmitters (10W–5kW), FM transmitters (100W–30kW), and VHF/UHF TV transmitters. All firmware versions are vulnerable. No vendor patch is available.
What this means
What could happen
An attacker with network access and valid credentials could remotely run arbitrary commands on broadcast transmitters, disable broadcast service, or persistently maintain access to the device. This could disrupt radio and TV services that depend on these transmitters.
Who's at risk
Broadcast and media operators managing DAB, FM, or TV transmitters from Electrolink. This includes community radio stations, commercial FM broadcasters, digital radio networks, and TV transmitter operators of all power levels (10W to 40kW). Any organization relying on these transmitters for continuous broadcast service should prioritize mitigation.
How it could be exploited
An attacker with valid login credentials and network access to a transmitter (typically via management interface on port 80/443 or SSH) can exploit authentication bypass, privilege escalation, or code execution flaws to gain full control of the device and execute arbitrary code or configuration changes that disable or manipulate broadcasting.
Prerequisites
- Valid authentication credentials for the transmitter management interface
- Network access to the transmitter (direct or via remote management)
- Knowledge of the transmitter's IP address and accessible management port
no patch availableauthenticated access required but credentials may be shared or defaulthigh CVSS (8.8)affects broadcast service availabilityall firmware versions vulnerable
Exploitability
Moderate exploit probability (EPSS 9.6%)
Affected products (24)
24 EOL
ProductAffected VersionsFix Status
10W Compact DAB Transmitter: vers:all/*All versionsNo fix (EOL)
100W Compact DAB Transmitter: vers:all/*All versionsNo fix (EOL)
250W Compact DAB Transmitter: vers:all/*All versionsNo fix (EOL)
500W Medium DAB Transmitter: vers:all/*All versionsNo fix (EOL)
1kW Medium DAB Transmitter: vers:all/*All versionsNo fix (EOL)
Remediation & Mitigation
0/6
Do now
0/4HARDENINGIsolate all Electrolink transmitters from internet-facing networks and place them behind firewalls with strict access controls
HARDENINGRestrict network access to transmitter management interfaces to authorized engineering workstations only, using network segmentation or access control lists (ACLs)
HARDENINGIf remote access to transmitters is required, implement a VPN with strong authentication and keep VPN software patched to the latest version
WORKAROUNDContact Electrolink to request security updates, patches, or end-of-life guidance for affected transmitter models
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HARDENINGEnforce strong, unique credentials for all transmitter management accounts and implement multi-factor authentication if supported
HARDENINGMonitor transmitter management logs and network traffic for unauthorized access attempts; report suspicious activity to CISA
CVEs (7)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/50b0d030-6e3c-4f3f-80c1-ce57f65f817b