by Kastro
Paper/Archive/CVE-2025-66251

CVE-2025-66251

DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter — Unauthenticated Path Traversal with Arbitrary File Deletion

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 44.3.443 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows path traversal deletion of arbitrary .tgz files.

Affected

ProductAffectedFixed inSource
Mozart FM Transmitter30–CNA
Mozart FM Transmitter50–CNA
Mozart FM Transmitter100–CNA
Mozart FM Transmitter300–CNA
Mozart FM Transmitter500–CNA
Mozart FM Transmitter1000–CNA
Mozart FM Transmitter2000–CNA
Mozart FM Transmitter3000–CNA
Mozart FM Transmitter3500–CNA
Mozart FM Transmitter6000–CNA
Mozart FM Transmitter7000–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Gridware (CNA)7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

exploitabdulmhsblog.com/posts/webfmvulns