VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) Remote Denial Of Service
Title: VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) Remote Denial Of Service
Advisory ID: ZSL-2023-5798
Type: Local/Remote
Impact: DoS
Risk: (4/5)
Release Date: 19.10.2023
[24.07.2023] Vendor contacted.
[14.10.2023] No response from the vendor.
[15.10.2023] Vendor contacted.
[18.10.2023] No response from the vendor.
[19.10.2023] Public security advisory released.
[2] https://cxsecurity.com/issue/WLB-2023100045
[3] https://www.exploit-db.com/exploits/51793
[4] https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-01
[5] https://www.cve.org/CVERecord?id=CVE-2024-9692
[6] https://nvd.nist.gov/vuln/detail/CVE-2024-9692
[25.10.2023] - Added reference [1] and [2]
[14.02.2024] - Added reference [3]
[24.10.2024] - Added reference [4], [5] and [6]
Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2023-5798
Type: Local/Remote
Impact: DoS
Risk: (4/5)
Release Date: 19.10.2023
Summary
The transmitter Blue Plus is designed with all the latest technologies, such as high efficiency using the latest generation LDMOS transistor and high efficiency power supplies. We used a modern interface and performance using a color display with touch screen, with easy management software and easy to use. The transmitter is equipped with all audio input including Audio IP for a complete audio interface. The VHF/FM transmitter 30-1000 is intended for the transmission of frequency modulated broadcasts in mono or stereo. It work with broadband characteristics in the VHF frequency range from 87.5-108 MHz and can be operated with any frequency in this range withoug alignment. The transmitter output power is variable between 10 and 110% of the nominal Power. It is available with different remote control ports. It can store up to six broadcast programs including program specific parameters such as frequency, RF output power, modulation type, RDS, AF level and deviation limiting. The transmitter is equipped with a LAN interface that permits the complete remote control of the transmitter operation via SNMP or Web Server.Description
The device is suffering from a Denial of Service (DoS) vulnerability. An unauthenticated attacker can issue an unauthorized HTTP GET request to the unprotected endpoint 'doreboot' and restart the transmitter operations.Vendor
Video Medios, S.A. (VIMESA) - https://www.vimesa.esAffected Version
img:v9.7.1 Html:v2.4 RS485:v2.5Tested On
lighttpd/1.4.32Vendor Status
[22.07.2023] Vulnerability discovered.[24.07.2023] Vendor contacted.
[14.10.2023] No response from the vendor.
[15.10.2023] Vendor contacted.
[18.10.2023] No response from the vendor.
[19.10.2023] Public security advisory released.
PoC
vimesa_dos.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://packetstormsecurity.com/files/175259/[2] https://cxsecurity.com/issue/WLB-2023100045
[3] https://www.exploit-db.com/exploits/51793
[4] https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-01
[5] https://www.cve.org/CVERecord?id=CVE-2024-9692
[6] https://nvd.nist.gov/vuln/detail/CVE-2024-9692
Changelog
[19.10.2023] - Initial release[25.10.2023] - Added reference [1] and [2]
[14.02.2024] - Added reference [3]
[24.10.2024] - Added reference [4], [5] and [6]
Contact
Zero Science LabWeb: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk
