Lucene search

Gjoko KrsticZSL-2024-5809

HistoryJan 31, 2024 - 12:00 a.m.

TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account

2024-01-3100:00:00

Gjoko Krstic

zeroscience.mk

124

telsat markoni fm transmitter

backdoor account

super administrative account

hardcoded password

web management access

vulnerability

script file vulnerability

system access

elevation of privilege

dos

security bypass

sensitive information exposure

system information exposure

vendor contact

public security advisory

zero science lab.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

High

EPSS

0.001

Percentile

39.6%

JSON

Title: TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account
Advisory ID: ZSL-2024-5809
Type: Local/Remote
Impact: System Access, Elevation of Privilege, DoS, Security Bypass, Exposure of Sensitive Information, Exposure of System Information
Risk: (5/5)
Release Date: 31.01.2024

Summary

Professional FM transmitters.

Description

The transmitter has a hidden super administrative account ‘factory’ that has the hardcoded password ‘inokram25’ that allows full access to the web management interface configuration. The factory account is not visible in the users page of the application and the password cannot be changed through any normal operation of the device. The backdoor lies in the /js_files/LogIn_local.js script file. Attackers could exploit this vulnerability by logging in using the backdoor credentials for the web panel gaining also additional functionalities including: unit configuration, parameter modification, EEPROM overwrite, clearing DB, and factory log modification.

Vendor

TELSAT Srl - <https://www.markoni.it>

Affected Version

Markoni-D (Compact) FM Transmitters
Markoni-DH (Exciter+Amplifiers) FM Transmitters
Markoni-A (Analogue Modulator) FM Transmitters
Firmware: 1.9.5
1.9.3
1.5.9
1.4.6
1.3.9

Tested On

GNU/Linux 3.10.53 (armv7l)
icorem6solox
lighttpd/1.4.33

Vendor Status

[10.11.2023] Vulnerability discovered.
[21.11.2023] Contact with the vendor.
[22.11.2023] No response from the vendor.
[19.01.2024] Contact with the vendor.
[29.01.2024] No response from the vendor.
[31.01.2024] Public security advisory released.

PoC

markoni_backdoor.txt

Credits

Vulnerability discovered by Gjoko Krstic - <[email protected]>

References

[1] <https://packetstormsecurity.com/files/176934/>
[2] <https://www.exploit-db.com/exploits/51907>
[3] <https://exchange.xforce.ibmcloud.com/vulnerabilities/286365>
[4] <https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-01>
[5] <https://vulners.com/cve/CVE-2024-39374>
[6] <https://nvd.nist.gov/vuln/detail/CVE-2024-39374>

Changelog

[31.01.2024] - Initial release
[01.02.2024] - Added reference [1]
[19.03.2024] - Added reference [2]
[28.03.2024] - Added reference [3]
[01.07.2024] - Added reference [4], [5] and [6]

Contact

Zero Science Lab

Web: <https://www.zeroscience.mk>
e-mail: [email protected]

<html><body><p>TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account


Vendor: TELSAT Srl
Product web page: https://www.markoni.it
Affected version: Markoni-D (Compact) FM Transmitters
                  Markoni-DH (Exciter+Amplifiers) FM Transmitters
                  Markoni-A (Analogue Modulator) FM Transmitters
                  Firmware: 1.9.5
                            1.9.3
                            1.5.9
                            1.4.6
                            1.3.9

Summary: Professional FM transmitters.

Desc: The transmitter has a hidden super administrative account 'factory'
that has the hardcoded password 'inokram25' that allows full access to
the web management interface configuration. The factory account is not
visible in the users page of the application and the password cannot be
changed through any normal operation of the device. The backdoor lies in
the /js_files/LogIn_local.js script file. Attackers could exploit this
vulnerability by logging in using the backdoor credentials for the web
panel gaining also additional functionalities including: unit configuration,
parameter modification, EEPROM overwrite, clearing DB, and factory log
modification.

Tested on: GNU/Linux 3.10.53 (armv7l)
           icorem6solox
           lighttpd/1.4.33


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2024-5809
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5809.php
CWE ID: 912
CWE URL: https://cwe.mitre.org/data/definitions/912.html


10.11.2023

--


The credentials can be seen in the auto_login() JS function in the
unprotected /js_files/LogIn_local.js file:

$ curl -s http://10.0.8.3:88/js_files/LogIn_local.js |grep -A2 "auto_login()"

function auto_login() {     // @mod1
    var username = "factory";
    var password = "inokram25";
$ </p></body></html>

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

High

EPSS

0.001

Percentile

39.6%

JSON

Related for ZSL-2024-5809