CVE-2024-1491: 0xacab MAT2

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial flash, or internal flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

Affected products

• 0xacab MAT2: version 0.10.0 only
• Electrolink Compact Dab Transmitter: version 10W only; version 100W only; version 250W only
• Electrolink Compact Fm Transmitter: version 500W only; version 1kW only; version 2kW only
• Electrolink Digital Fm Transmitter: from 15W, up to and including 40kW
• Electrolink High Power Dab Transmitter: version 2.5kW only; version 3kW only; version 4kW only; version 5kW only
• Electrolink Medium Dab Transmitter: version 500W only; version 1kW only; version 2kW only
• Electrolink Modular Fm Transmitter: version 3kW only; version 5kW only; version 10kW only; version 15kW only; version 20kW only; version 30kW only
• Electrolink Uhf Tv Transmitter: from 10W, up to and including 5kW
• Electrolink Vhf Tv Transmitter

Published 2024-04-18. Last modified 2026-06-17.