Vulnerability · Published Feb 6, 2025 · Assigned by icscert
CVE-2025-0674Elber Communications Equipment Authentication Bypass Using an Alternate Path or Channel
Critical 9.8
In plain English
A critical-severity authentication bypass in Cleber/3 Broadcast Multi-Purpose Platform from Elber. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system. This grants them unauthorized administrative access to protected areas of the application, compromising the device's system security.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elber | Signum DVB-S/S2 IRD | 0 – through 1.999 |
| Elber | Cleber/3 Broadcast Multi-Purpose Platform | 1.0 |
| Elber | Reble610 M/ODU XPIC IP-ASI-SDH | 0.01 |
| Elber | ESE DVB-S/S2 Satellite Receiver | 0 – through 1.5.179 |
| Elber | Wayber Analog/Digital Audio STL | 4 |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H