by Kastro
Paper/Archive/CVE-2025-66250

CVE-2025-66250

DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter — Unauthenticated Arbitrary File Upload (status_contents.php)

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.5.405 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.

Affected

ProductAffectedFixed inSource
Mozart FM Transmitter30–CNA
Mozart FM Transmitter50–CNA
Mozart FM Transmitter100–CNA
Mozart FM Transmitter300–CNA
Mozart FM Transmitter500–CNA
Mozart FM Transmitter1000–CNA
Mozart FM Transmitter2000–CNA
Mozart FM Transmitter3000–CNA
Mozart FM Transmitter3500–CNA
Mozart FM Transmitter6000–CNA
Mozart FM Transmitter7000–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Gridware (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

exploitabdulmhsblog.com/posts/webfmvulns