← Advisories

Sielco Analog FM Transmitter 2.12 Remote Privilege Escalation

High
Advisory ID
ZSL-2023-5755
Release Date
28 March 2023
Vendor
Sielco S.r.l - https://www.sielco.org
Affected Version
2.12 (EXC5000GX), 2.12 (EXC120GX), 2.11 (EXC300GX), 2.10 (EXC1600GX), 2.10 (EXC2000GX), 2.08 (EXC1600GX), 2.08 (EXC1000GX), 2.07 (EXC3000GX), 2.06 (EXC5000GX), 1.7.7 (EXC30GT), 1.7.4 (EXC300GT), 1.7.4 (EXC100GT), 1.7.4 (EXC5000GT), 1.6.3 (EXC1000GT), 1.5.4 (EXC120GT)
Tested On
lwIP/2.1.1, Web/3.0.3
Summary

Sielco designs and produces FM radio transmitters for professional broadcasting. The in-house laboratory develops standard and customised solutions to meet all needs. Whether digital or analogue, each product is studied to ensure reliability, resistance over time and a high standard of safety. Sielco transmitters are distributed throughout the world and serve many radios in Europe, South America, Africa, Oceania and China.

Description

The application suffers from a privilege escalation vulnerability. A user with Read permissions can elevate his/her privileges by sending a HTTP POST request setting the parameter 'auth1' or 'auth2' or 'auth3' to integer value '1' for Write or '2' for Admin permissions.

Proof of Concept
Disclosure Timeline
26.01.2023Vulnerability discovered.
27.01.2023Contact with the vendor and CSIRT Italia.
27.03.2023No response from the vendor.
27.03.2023No response from the CSIRT team.
28.03.2023Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
28.03.2023Initial release
02.11.2023Added reference [1], [2], [3], [4], [5], [6], [7] and [8]