by Kastro
Paper/Archive/CVE-2025-66255

CVE-2025-66255

DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter — Unauthenticated Arbitrary File Upload (upgrade_contents.php)

EPSS 0.4%public exploitCVSS 9.9
critical.is priorityof 100
47
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 34.8.348 × 207.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages.  The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution

Affected

ProductAffectedFixed inSource
Mozart FM Transmitter30–CNA
Mozart FM Transmitter50–CNA
Mozart FM Transmitter100–CNA
Mozart FM Transmitter300–CNA
Mozart FM Transmitter500–CNA
Mozart FM Transmitter1000–CNA
Mozart FM Transmitter2000–CNA
Mozart FM Transmitter3000–CNA
Mozart FM Transmitter3500–CNA
Mozart FM Transmitter6000–CNA
Mozart FM Transmitter7000–CNA

Scores by source

Gridware (CNA)9.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitabdulmhsblog.com/posts/webfmvulns