gsd-2024-22179
Vulnerability from gsd
Modified
2024-01-06 06:02
Details
The application is vulnerable to an unauthenticated parameter
manipulation that allows an attacker to set the credentials to blank
giving her access to the admin panel. Also vulnerable to account
takeover and arbitrary password change.
Aliases
{
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2024-22179"
],
"details": "\nThe application is vulnerable to an unauthenticated parameter \nmanipulation that allows an attacker to set the credentials to blank \ngiving her access to the admin panel. Also vulnerable to account \ntakeover and arbitrary password change.\n\n",
"id": "GSD-2024-22179",
"modified": "2024-01-06T06:02:13.767558Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2024-22179",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Compact DAB Transmitter",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10W"
},
{
"version_affected": "=",
"version_value": "100W"
},
{
"version_affected": "=",
"version_value": "250W"
}
]
}
},
{
"product_name": "Medium DAB Transmitter",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "500W"
},
{
"version_affected": "=",
"version_value": "1kW"
},
{
"version_affected": "=",
"version_value": "2kW"
}
]
}
},
{
"product_name": "High Power DAB Transmitter",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2.5kW"
},
{
"version_affected": "=",
"version_value": "3kW"
},
{
"version_affected": "=",
"version_value": "4kW"
},
{
"version_affected": "=",
"version_value": "5kW "
}
]
}
},
{
"product_name": "Compact FM Transmitter",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "Compact FM Transmitter"
},
{
"version_affected": "=",
"version_value": "500W"
},
{
"version_affected": "=",
"version_value": "1kW"
},
{
"version_affected": "=",
"version_value": "2kW "
}
]
}
},
{
"product_name": "Modular FM Transmitter",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "3kW"
},
{
"version_affected": "=",
"version_value": "5kW"
},
{
"version_affected": "=",
"version_value": "10kW"
},
{
"version_affected": "=",
"version_value": "15kW"
},
{
"version_affected": "=",
"version_value": "20kW"
},
{
"version_affected": "=",
"version_value": "30kW "
}
]
}
},
{
"product_name": "Digital FM Transmitter",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "15W ",
"version_value": "40kW "
}
]
}
},
{
"product_name": "VHF TV Transmitter",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "BI"
},
{
"version_affected": "=",
"version_value": "BIII "
}
]
}
},
{
"product_name": "UHF TV Transmitter",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "10W ",
"version_value": "5kW "
}
]
}
}
]
},
"vendor_name": "Electrolink "
}
]
}
},
"credits": [
{
"lang": "en",
"value": "Gjoko Krstic publicly reported these vulnerabilities on the internet after an unsuccessful attempt to contact Electrolink directly."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "\nThe application is vulnerable to an unauthenticated parameter \nmanipulation that allows an attacker to set the credentials to blank \ngiving her access to the admin panel. Also vulnerable to account \ntakeover and arbitrary password change.\n\n"
}
]
},
"generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-302",
"lang": "eng",
"value": "CWE-302"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"
}
]
},
"source": {
"advisory": "ICSA-24-107-02",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nElectrolink has not responded to requests to work with CISA to mitigate \nthese vulnerabilities. Users of the affected products are encouraged to \ncontact \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://electrolink.com/contacts/\"\u003eElectrolink\u003c/a\u003e for additional information.\n\n\u003cbr\u003e"
}
],
"value": "Electrolink has not responded to requests to work with CISA to mitigate \nthese vulnerabilities. Users of the affected products are encouraged to \ncontact Electrolink https://electrolink.com/contacts/ for additional information.\n\n"
}
]
},
"nvd.nist.gov": {
"cve": {
"descriptions": [
{
"lang": "en",
"value": "\nThe application is vulnerable to an unauthenticated parameter \nmanipulation that allows an attacker to set the credentials to blank \ngiving her access to the admin panel. Also vulnerable to account \ntakeover and arbitrary password change.\n\n"
},
{
"lang": "es",
"value": "La aplicaci\u00f3n es vulnerable a una manipulaci\u00f3n de par\u00e1metros no autenticados que permite a un atacante dejar las credenciales en blanco, d\u00e1ndole acceso al panel de administraci\u00f3n. Tambi\u00e9n vulnerable a la apropiaci\u00f3n de cuentas y al cambio arbitrario de contrase\u00f1a."
}
],
"id": "CVE-2024-22179",
"lastModified": "2024-04-19T13:10:25.637",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
}
]
},
"published": "2024-04-18T22:15:09.850",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-302"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Primary"
}
]
}
}
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.