github - ghsa-xww2-7grc-g9mp

GHSA-XWW2-7GRC-G9MP

Vulnerability from github – Published: 2024-04-19 00:30 – Updated: 2024-04-19 00:30

Details

The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-1491"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-18T23:15:06Z",
    "severity": "HIGH"
  },
  "details": "\nThe devices allow access to an unprotected endpoint that allows MPFS \nfile system binary image upload without authentication. The MPFS2 file \nsystem module provides a light-weight read-only file system that can be \nstored in external EEPROM, external serial flash, or internal flash \nprogram memory. This file system serves as the basis for the HTTP2 web \nserver module, but is also used by the SNMP module and is available to \nother applications that require basic read-only storage capabilities. \nThis can be exploited to overwrite the flash program memory that holds \nthe web server\u0027s main interfaces and execute arbitrary code.\n\n",
  "id": "GHSA-xww2-7grc-g9mp",
  "modified": "2024-04-19T00:30:54Z",
  "published": "2024-04-19T00:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1491"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-1491 (GCVE-0-2024-1491)

Vulnerability from cvelistv5 – Published: 2024-04-18 22:13 – Updated: 2024-08-01 18:40

Title

Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

Summary

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

icscert

References

URL

Tags

https://www.cisa.gov/news-events/ics-advisories/i…

Impacted products

Vendor

Product

Version

Electrolink

Compact DAB Transmitter

Affected: 10W
Affected: 100W
Affected: 250W

Electrolink	Medium DAB Transmitter	Affected: 500W Affected: 1kW Affected: 2kW
Electrolink	High Power DAB Transmitter	Affected: 2.5kW Affected: 3kW Affected: 4kW Affected: 5kW
Electrolink	Compact FM Transmitter	Affected: Compact FM Transmitter Affected: 500W Affected: 1kW Affected: 2kW
Electrolink	Modular FM Transmitter	Affected: 3kW Affected: 5kW Affected: 10kW Affected: 15kW Affected: 20kW Affected: 30kW
Electrolink	Digital FM Transmitter	Affected: 15W , ≤ 40kW (custom)
Electrolink	VHF TV Transmitter	Affected: BI Affected: BIII
Electrolink	UHF TV Transmitter	Affected: 10W , ≤ 5kW (custom)

Credits

Gjoko Krstic publicly reported these vulnerabilities on the internet after an unsuccessful attempt to contact Electrolink directly.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:0xacab:mat2:0.10.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mat2",
            "vendor": "0xacab",
            "versions": [
              {
                "status": "affected",
                "version": "0.10.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T00:25:00.939738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:01:37.950Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:40:21.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compact DAB Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "status": "affected",
              "version": "10W"
            },
            {
              "status": "affected",
              "version": "100W"
            },
            {
              "status": "affected",
              "version": "250W"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Medium DAB Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "status": "affected",
              "version": "500W"
            },
            {
              "status": "affected",
              "version": "1kW"
            },
            {
              "status": "affected",
              "version": "2kW"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "High Power DAB Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "status": "affected",
              "version": "2.5kW"
            },
            {
              "status": "affected",
              "version": "3kW"
            },
            {
              "status": "affected",
              "version": "4kW"
            },
            {
              "status": "affected",
              "version": "5kW"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Compact FM Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "status": "affected",
              "version": "Compact FM Transmitter"
            },
            {
              "status": "affected",
              "version": "500W"
            },
            {
              "status": "affected",
              "version": "1kW"
            },
            {
              "status": "affected",
              "version": "2kW"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Modular FM Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "status": "affected",
              "version": "3kW"
            },
            {
              "status": "affected",
              "version": "5kW"
            },
            {
              "status": "affected",
              "version": "10kW"
            },
            {
              "status": "affected",
              "version": "15kW"
            },
            {
              "status": "affected",
              "version": "20kW"
            },
            {
              "status": "affected",
              "version": "30kW"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Digital FM Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "lessThanOrEqual": "40kW",
              "status": "affected",
              "version": "15W",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VHF TV Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "status": "affected",
              "version": "BI"
            },
            {
              "status": "affected",
              "version": "BIII"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "UHF TV Transmitter",
          "vendor": "Electrolink",
          "versions": [
            {
              "lessThanOrEqual": "5kW",
              "status": "affected",
              "version": "10W",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gjoko Krstic publicly reported these vulnerabilities on the internet after an unsuccessful attempt to contact Electrolink directly."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The devices allow access to an unprotected endpoint that allows MPFS \nfile system binary image upload without authentication. The MPFS2 file \nsystem module provides a light-weight read-only file system that can be \nstored in external EEPROM, external serial flash, or internal flash \nprogram memory. This file system serves as the basis for the HTTP2 web \nserver module, but is also used by the SNMP module and is available to \nother applications that require basic read-only storage capabilities. \nThis can be exploited to overwrite the flash program memory that holds \nthe web server\u0027s main interfaces and execute arbitrary code."
            }
          ],
          "value": "The devices allow access to an unprotected endpoint that allows MPFS \nfile system binary image upload without authentication. The MPFS2 file \nsystem module provides a light-weight read-only file system that can be \nstored in external EEPROM, external serial flash, or internal flash \nprogram memory. This file system serves as the basis for the HTTP2 web \nserver module, but is also used by the SNMP module and is available to \nother applications that require basic read-only storage capabilities. \nThis can be exploited to overwrite the flash program memory that holds \nthe web server\u0027s main interfaces and execute arbitrary code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-28T16:51:09.051Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"
        }
      ],
      "source": {
        "advisory": "ICSA-24-107-02",
        "discovery": "EXTERNAL"
      },
      "title": "Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Electrolink has not responded to requests to work with CISA to mitigate \nthese vulnerabilities. Users of the affected products are encouraged to \ncontact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://electrolink.com/contacts/\"\u003eElectrolink\u003c/a\u003e for additional information.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Electrolink has not responded to requests to work with CISA to mitigate \nthese vulnerabilities. Users of the affected products are encouraged to \ncontact  Electrolink https://electrolink.com/contacts/  for additional information."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2024-1491",
    "datePublished": "2024-04-18T22:13:54.962Z",
    "dateReserved": "2024-02-14T15:46:18.806Z",
    "dateUpdated": "2024-08-01T18:40:21.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XWW2-7GRC-G9MP

CVE-2024-1491 (GCVE-0-2024-1491)

Tags

Sightings

Nomenclature