TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass

`  
TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass  
  
  
Vendor: TELSAT Srl  
Product web page: https://www.markoni.it  
Affected version: Markoni-D (Compact) FM Transmitters  
Markoni-DH (Exciter+Amplifiers) FM Transmitters  
Markoni-A (Analogue Modulator) FM Transmitters  
Firmware: 1.9.5  
1.9.3  
1.5.9  
1.4.6  
1.3.9  
  
Summary: Professional FM transmitters.  
  
Desc: The application implements client-side restrictions that can  
be bypassed by editing the HTML source page that enable administrative  
operations.  
  
Tested on: GNU/Linux 3.10.53 (armv7l)  
icorem6solox  
lighttpd/1.4.33  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
Macedonian Information Security Research and Development Laboratory  
Zero Science Lab - https://www.zeroscience.mk - @zeroscience  
  
  
Advisory ID: ZSL-2024-5810  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5810.php  
  
  
10.11.2023  
  
--  
  
  
These few JavaScript functions can be called directly in the browser's console  
and can enable a user to execute and apply modifications with admin rights.  
There are plenty more functions throughout the web application's interface.  
  
set_wget()  
change_ip_settings()  
change_web_port()  
set_sendtime()  
add_mailaddress()  
set_mailinglist()  
...  
...  
`