Title: Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass Exploit
Advisory ID: ZSL-2023-5769
Impact: Privilege Escalation, Security Bypass, System Access
Release Date: 10.04.2023
PolyEco is the innovative family of high-end digitalFM transmitters of Sielco. They are especially suited as highperformance power system exciters or compact low-mid powertransmitters. The same cabinet may in fact be fitted with 50,100, 300, 500, 1000W power stage (PolyEco50, 100, 300, 500,1000).
All features can be controlled via the large touch-screen display4.3\” or remotely. Many advanced features are inside by defaultin the basic version such as: stereo and RDS encoder, audiochange-over, remote-control via LAN and SNMP, \”FFT\” spectralanalysis of the audio sources, SFN synchronization and much more.
The application suffers from an authentication bypass andaccount takeover/lockout vulnerability that can be triggered bydirectly calling the users object and effectively modifying thepassword of the two constants user/role (user/admin). This canbe exploited by an unauthenticated adversary by issuing a singlePOST request to the vulnerable endpoint and gain unauthorizedaccess to the affected device with administrative privileges.
Sielco S.r.l – https://www.sielco.org
PolyEco1000 CPU:2.0.6 FPGA:10.19
PolyEco1000 CPU:1.9.4 FPGA:10.19
PolyEco1000 CPU:1.9.3 FPGA:10.19
PolyEco500 CPU:1.7.0 FPGA:10.16
PolyEco300 CPU:2.0.2 FPGA:10.19
PolyEco300 CPU:2.0.0 FPGA:10.19
[26.01.2023] Vulnerability discovered.
[27.01.2023] Contact with the vendor and CSIRT Italia.
[09.04.2023] No response from the vendor.
[09.04.2023] No response from the CSIRT team.
[10.04.2023] Public security advisory released.
Vulnerability discovered by Gjoko Krstic – <email@example.com>
[10.04.2023] – Initial release
Zero Science Lab