ELCA Star Transmitter CVE-2025-63209 Info Disclosure via /setup.xml

Critical Vulnerability Information Vulnerability Description The firmware of ELCA Star Transmitter Remote Control contains an information disclosure vulnerability that allows unauthorized attackers to retrieve administrator credentials and system settings via an unprotected endpoint. The administrator password is stored in plain text under the XML tag, potentially enabling remote attackers to take full control of the transmitter system. Vulnerability Details CVE ID: CVE-2025-63209 Vulnerability Type: Information Disclosure Impact Level: Severe Affected Component: setup.xml Attack Method: Unauthorized GET request to to obtain administrator credentials and other system configuration data. Impact Severity: Critical Description: Attackers can exploit this information disclosure vulnerability by sending unauthorized GET requests to , retrieving the plain-text administrator password stored in the field, and potentially gaining full remote control over the transmitter system. Affected Products and Versions Product: ELCA Star Transmitter Remote Control Firmware/Software Versions: STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500. Vulnerable Endpoint Interface: Attack Type Type: Exposure of Sensitive Information Classification: Unauthorized Access to Credentials Proof of Concept (PoC) 1. Identify the target transmitter's IP address. 2. Send an unauthorized GET request to . 3. Inspect the response to locate the plain-text field containing the administrator password. 4. Use the extracted credentials to log in and gain full control over the transmission system. Discoverer Mohamed Shahat Recommended Mitigation Measures Restrict access to to ensure it is inaccessible without proper authorization. Eliminate plain-text password storage and implement encrypted credential storage. Enforce appropriate authentication controls, requiring administrator verification before accessing sensitive configuration files. Enable logging and monitoring to track access to configuration files and generate alerts for unauthorized attempts.

Goal Reached Thanks to every supporter — we hit 100%!

ELCA Star Transmitter CVE-2025-63209 Info Disclosure via /setup.xml

More from this source