#VU103701 Authentication bypass using an alternate path or channel in Elber products - CVE-2025-0674

Vulnerability identifier: #VU103701

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-0674

CWE-ID: CWE-288

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Signum DVB-S/S2 IRD
Hardware solutions / Firmware
Cleber/3 Broadcast Multi-Purpose Platform
Hardware solutions / Firmware
Reble610 M/ODU XPIC IP-ASI-SDH
Hardware solutions / Firmware
ESE DVB-S/S2 Satellite Receiver
Hardware solutions / Firmware
Wayber Analog/Digital Audio STL
Hardware solutions / Firmware

Vendor: Elber

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the authentication bypass using an alternate path or channel. A remote attacker can manipulate the endpoint to overwrite any user's password within the system and gain elevated privileges.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Signum DVB-S/S2 IRD: 1.999

Cleber/3 Broadcast Multi-Purpose Platform: 1.0

Reble610 M/ODU XPIC IP-ASI-SDH: 0.01

ESE DVB-S/S2 Satellite Receiver: 1.5.179

Wayber Analog/Digital Audio STL: 4.0

---

External links
https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.