CVE-2024-22186

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The application suffers from a privilege escalation vulnerability. An attacker logged in as guest can escalate his privileges by poisoning the cookie to become administrator.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-565

Affected software

VendorProductVersions
ElectrolinkCompact DAB Transmitter10W; 100W; 250W
ElectrolinkMedium DAB Transmitter500W; 1kW; 2kW
ElectrolinkHigh Power DAB Transmitter2.5kW; 3kW; 4kW; 5kW
ElectrolinkCompact FM TransmitterCompact FM Transmitter; 500W; 1kW; 2kW
ElectrolinkModular FM Transmitter3kW; 5kW; 10kW; 15kW; 20kW; 30kW
ElectrolinkDigital FM Transmitter>= 15W, <= 40kW
ElectrolinkVHF TV TransmitterBI; BIII
ElectrolinkUHF TV Transmitter>= 10W, <= 5kW
electrolinkcompact dab transmitter10w
electrolinkcompact dab transmitter100w
electrolinkcompact dab transmitter250w
electrolinkmedium dab transmitter1kw
electrolinkmedium dab transmitter2kw
electrolinkmedium dab transmitter500w
electrolinkhigh power dab transmitter2.5kw
electrolinkhigh power dab transmitter3kw
electrolinkhigh power dab transmitter4kw
electrolinkhigh power dab transmitter5kw
electrolinkcompact fm transmitter500w
electrolinkcompact fm transmitter1kw
electrolinkcompact fm transmitter2kw
electrolinkmodular fm transmitter3kw
electrolinkmodular fm transmitter5kw
electrolinkmodular fm transmitter10kw
electrolinkmodular fm transmitter15kw
electrolinkmodular fm transmitter20kw
electrolinkmodular fm transmitter30kw
electrolinkdigital fm transmitter15w
electrolinkvhf tv transmitterbi
electrolinkvhf tv transmitterbii
electrolinkuhf tv transmitter10w

References

Timeline

Published
Apr 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-221879.1A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect PCVE-2024-221887.2TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the priCVE-2024-221897.5quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sendinCVE-2024-221907.8GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uCVE-2024-221915.4Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_valCVE-2024-221926.5Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has aCVE-2024-221934.3The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party ComputationCVE-2024-221942.8cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic CVE-2024-221956.1Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible tCVE-2024-221966.5Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This isCVE-2024-221978.8Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home CVE-2024-221988.8Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration set
CVE-2024-22186: High severity, CVSS 8.8 | Vulnix