Lucene search

Gjoko KrsticZSL-2024-5810

HistoryJan 31, 2024 - 12:00 a.m.

TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass

2024-01-3100:00:00

Gjoko Krstic

zeroscience.mk

117

telsat

markoni

transmitter

access control

bypass

html

source page

firmware

gnu/linux

lighttpd

vulnerability

security advisory

zero science lab

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

39.6%

JSON

Title: TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass
Advisory ID: ZSL-2024-5810
Type: Local/Remote
Impact: Security Bypass
Risk: (4/5)
Release Date: 31.01.2024

Summary

Professional FM transmitters.

Description

The application implements client-side restrictions that can be bypassed by editing the HTML source page that enable administrative operations.

Vendor

TELSAT Srl - <https://www.markoni.it>

Affected Version

Markoni-D (Compact) FM Transmitters
Markoni-DH (Exciter+Amplifiers) FM Transmitters
Markoni-A (Analogue Modulator) FM Transmitters
Firmware: 1.9.5
1.9.3
1.5.9
1.4.6
1.3.9

Tested On

GNU/Linux 3.10.53 (armv7l)
icorem6solox
lighttpd/1.4.33

Vendor Status

[10.11.2023] Vulnerability discovered.
[21.11.2023] Contact with the vendor.
[22.11.2023] No response from the vendor.
[19.01.2024] Contact with the vendor.
[29.01.2024] No response from the vendor.
[31.01.2024] Public security advisory released.

PoC

markoni_acbypass.txt

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <https://packetstormsecurity.com/files/176935/>
[2] <https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-01>
[3] <https://vulners.com/cve/CVE-2024-39375>
[4] <https://nvd.nist.gov/vuln/detail/CVE-2024-39375>

Changelog

[31.01.2024] - Initial release
[01.02.2024] - Added reference [1]
[01.07.2024] - Added reference [2], [3] and [4]

Contact

Zero Science Lab

Web: <https://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass


Vendor: TELSAT Srl
Product web page: https://www.markoni.it
Affected version: Markoni-D (Compact) FM Transmitters
                  Markoni-DH (Exciter+Amplifiers) FM Transmitters
                  Markoni-A (Analogue Modulator) FM Transmitters
                  Firmware: 1.9.5
                            1.9.3
                            1.5.9
                            1.4.6
                            1.3.9

Summary: Professional FM transmitters.

Desc: The application implements client-side restrictions that can
be bypassed by editing the HTML source page that enable administrative
operations.

Tested on: GNU/Linux 3.10.53 (armv7l)
           icorem6solox
           lighttpd/1.4.33


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2024-5810
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5810.php


10.11.2023

--


These few JavaScript functions can be called directly in the browser's console
and can enable a user to execute and apply modifications with admin rights.
There are plenty more functions throughout the web application's interface.

set_wget()
change_ip_settings()
change_web_port()
set_sendtime()
add_mailaddress()
set_mailinglist()
...
...
</p></body></html>

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

39.6%

JSON

Related for ZSL-2024-5810