Title: Sielco PolyEco Digital FM Transmitter 2.0.6 Account Takeover / Lockout / EoP
Advisory ID: ZSL-2023-5765
Impact: Privilege Escalation, Security Bypass
Release Date: 10.04.2023
PolyEco is the innovative family of high-end digitalFM transmitters of Sielco. They are especially suited as highperformance power system exciters or compact low-mid powertransmitters. The same cabinet may in fact be fitted with 50,100, 300, 500, 1000W power stage (PolyEco50, 100, 300, 500,1000).
All features can be controlled via the large touch-screen display4.3\” or remotely. Many advanced features are inside by defaultin the basic version such as: stereo and RDS encoder, audiochange-over, remote-control via LAN and SNMP, \”FFT\” spectralanalysis of the audio sources, SFN synchronization and much more.
The application suffers from an authentication bypass,account takeover/lockout and elevation of privileges vulnerabilitythat can be triggered by directly calling the users object andeffectively modifying the password of the two constants user/role(user/admin). This can be exploited by an unauthenticated adversaryby issuing a single POST request to the vulnerable endpoint andgain unauthorized access to the affected device with administrativeprivileges.
Sielco S.r.l – https://www.sielco.org
PolyEco1000 CPU:2.0.6 FPGA:10.19
PolyEco1000 CPU:1.9.4 FPGA:10.19
PolyEco1000 CPU:1.9.3 FPGA:10.19
PolyEco500 CPU:1.7.0 FPGA:10.16
PolyEco300 CPU:2.0.2 FPGA:10.19
PolyEco300 CPU:2.0.0 FPGA:10.19
[26.01.2023] Vulnerability discovered.
[27.01.2023] Contact with the vendor and CSIRT Italia.
[09.04.2023] No response from the vendor.
[09.04.2023] No response from the CSIRT team.
[10.04.2023] Public security advisory released.
Vulnerability discovered by Gjoko Krstic – <email@example.com>
[10.04.2023] – Initial release
Zero Science Lab