Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass

Sielco PolyEco Digital FM Transmitter version 2.0.6 suffers from authentication bypass, account takeover / lockout, and privilege escalation vulnerabilities that can be triggered by directly calling the user object and modifying the password of the two constants user/role (user/admin). This can be exploited by an unauthenticated adversary by issuing a single POST request to the vulnerable endpoint and gain unauthorized access to the affected device with administrative privileges.

access account account takeover administrative privileges adversary authentication authentication bypass bypass device digital endpoint escalation exploited lockout object password privilege privilege escalation privileges request role single takeover unauthorized access version vulnerabilities vulnerable