The Patching Friars' AlmanacA calendar of CVE saints

December 24

Fermax DTMFHoly card for fermax-dtmf, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 1 # Fermax DTMF TONO APERITUR
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Fermax, Who Opened the Door With the Right Tone

Patron of door intercoms, DTMF tones, and anyone who, on Christmas Eve, waits for someone to buzz them in.

Life

Christmas night is the right night for a saint who opens doors: in the outdoor panel of Fermax intercoms, the DTMF tone receiver accepted the door-release command from anyone who played it into the speaker, not just from residents. An unknown visitor, whistling the tones for '1' and then '#' into the microphone, could buzz the door open and climb to the upper floors, like a Santa who comes in through the intercom instead of the chimney.

Prayer

O Saint Fermax, who opens doors to whoever knows the tone, let our intercoms listen only to those who live inside. Amen.

How to celebrate

Celebrated by asking the manufacturer for updated firmware and, when in doubt, going down to let expected guests in yourself.

Technical record

Disclosed on
December 24 2019
CVE
CVE-2017-16778

An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (DTMF) tone to invoke an access grant that would allow physical access to a restricted floor/level. By design, only a residential unit owner may allow such an access grant. However, due to incorrect access control, an attacker could inject it via the speaker unit to perform an access grant to gain unauthorized access, as demonstrated by a loud DTMF tone representing '1' and a long '#' (697 Hz and 1209 Hz, followed by 941 Hz and 1477 Hz).

Sources: nvd.nist.gov

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.