Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass Exploit|黑客技术网

Title: Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass Exploit
Advisory ID: ZSL-2023-5769
Type: Local/Remote
Impact: Privilege Escalation, Security Bypass, System Access
Risk: (5/5)
Release Date: 10.04.2023

Summary

PolyEco is the innovative family of high-end digitalFM transmitters of Sielco. They are especially suited as highperformance power system exciters or compact low-mid powertransmitters. The same cabinet may in fact be fitted with 50,100, 300, 500, 1000W power stage (PolyEco50, 100, 300, 500,1000).

All features can be controlled via the large touch-screen display4.3\” or remotely. Many advanced features are inside by defaultin the basic version such as: stereo and RDS encoder, audiochange-over, remote-control via LAN and SNMP, \”FFT\” spectralanalysis of the audio sources, SFN synchronization and much more.

Description

The application suffers from an authentication bypass andaccount takeover/lockout vulnerability that can be triggered bydirectly calling the users object and effectively modifying thepassword of the two constants user/role (user/admin). This canbe exploited by an unauthenticated adversary by issuing a singlePOST request to the vulnerable endpoint and gain unauthorizedaccess to the affected device with administrative privileges.

Vendor

Sielco S.r.l – https://www.sielco.org

Affected Version

PolyEco1000 CPU:2.0.6 FPGA:10.19
PolyEco1000 CPU:1.9.4 FPGA:10.19
PolyEco1000 CPU:1.9.3 FPGA:10.19
PolyEco500 CPU:1.7.0 FPGA:10.16
PolyEco300 CPU:2.0.2 FPGA:10.19
PolyEco300 CPU:2.0.0 FPGA:10.19

Tested On

lwIP/2.1.1 (http://savannah.nongnu.org/projects/lwip)

Vendor Status

[26.01.2023] Vulnerability discovered.
[27.01.2023] Contact with the vendor and CSIRT Italia.
[09.04.2023] No response from the vendor.
[09.04.2023] No response from the CSIRT team.
[10.04.2023] Public security advisory released.