TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account

🗓️ 31 Jan 2024 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 310 Views

TELSAT Markoni FM Transmitter 1.9.5 Backdoor Account - Hidden super admin 'factory' with hardcoded password 'inokram25', allowing full web management access. Vulnerability in /js_files/LogIn_local.js. Impact: System Access, Elevation of Privilege, DoS, Security Bypass, Exposure of Sensitive Information, Exposure of System Information

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2024-39374	27 Jun 202416:03	–	cve
Cvelist	CVE-2024-39374 Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter	27 Jun 202416:03	–	cvelist
EUVD	EUVD-2024-37924	3 Oct 202520:07	–	euvd
ICS	TELSAT marKoni FM Transmitter	27 Jun 202406:00	–	ics
NVD	CVE-2024-39374	27 Jun 202416:15	–	nvd
OSV	CVE-2024-39374	27 Jun 202416:15	–	osv
Positive Technologies	PT-2024-28475 · Telsat · Telsat Markoni Fm Transmitters	27 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-39374	9 Jan 202608:32	–	redhatcve
Vulnrichment	CVE-2024-39374 Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter	27 Jun 202416:03	–	vulnrichment

<html><body><p>TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account


Vendor: TELSAT Srl
Product web page: https://www.markoni.it
Affected version: Markoni-D (Compact) FM Transmitters
                  Markoni-DH (Exciter+Amplifiers) FM Transmitters
                  Markoni-A (Analogue Modulator) FM Transmitters
                  Firmware: 1.9.5
                            1.9.3
                            1.5.9
                            1.4.6
                            1.3.9

Summary: Professional FM transmitters.

Desc: The transmitter has a hidden super administrative account 'factory'
that has the hardcoded password 'inokram25' that allows full access to
the web management interface configuration. The factory account is not
visible in the users page of the application and the password cannot be
changed through any normal operation of the device. The backdoor lies in
the /js_files/LogIn_local.js script file. Attackers could exploit this
vulnerability by logging in using the backdoor credentials for the web
panel gaining also additional functionalities including: unit configuration,
parameter modification, EEPROM overwrite, clearing DB, and factory log
modification.

Tested on: GNU/Linux 3.10.53 (armv7l)
           icorem6solox
           lighttpd/1.4.33


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2024-5809
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5809.php
CWE ID: 912
CWE URL: https://cwe.mitre.org/data/definitions/912.html


10.11.2023

--


The credentials can be seen in the auto_login() JS function in the
unprotected /js_files/LogIn_local.js file:

$ curl -s http://10.0.8.3:88/js_files/LogIn_local.js |grep -A2 "auto_login()"

function auto_login() {     // @mod1
    var username = "factory";
    var password = "inokram25";
$ </p></body></html>

31 Jan 2024 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

CVSS 49.3

EPSS0.00205

SSVC