Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).
The `/var/tdf/start_upgrade.php` endpoint retrieves the `filename` parameter from an HTTP GET request (`$_GET["filename"]`) and passes it directly to the `exec()` function without any validation, sanitization, or escaping of shell special characters. An attacker can inject arbitrary system commands using shell metacharacters such as `;` or `|` by constructing a properly crafted HTTP request. Execution occurs in the context of the web server user, which on such embedded devices most likely runs with root privileges. The attack requires no authentication or any user interaction.
An attacker can gain full control over the device by remotely executing arbitrary system commands with root privileges, enabling persistent device compromise, disruption of FM transmission, and potential use of the device as an entry point for further network penetration (lateral movement).
Patches available from the manufacturer should be applied according to references. Until patches are deployed, it is recommended to isolate devices from public and untrusted networks, restrict access to the web interface exclusively to trusted IP addresses using a firewall, and monitor network traffic directed to the start_upgrade.php endpoint.
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter in versions: 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 (products from the Mozart Next and Mozart DDS Next product lines)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDbbroadcast Mozart Dds Next 100
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 1000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 1000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 100 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 2000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 2000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 30
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 300
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 3000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 3000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 300 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 30 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 3500
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 3500 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 50
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 500
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 500 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 50 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 6000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 6000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 7000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Dds Next 7000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 100
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 1000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 1000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 100 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 2000
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 2000 Firmware
OSDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 30
HWDbbroadcastwszystkie wersjeDbbroadcast Mozart Next 300
HWDbbroadcastwszystkie wersje
Related vulnerabilities
Nieuwierzytelnione usuwanie plików w DB Electronica Mozart FM Transmitter
Nieuwierzytelniony arbitrary file upload w DB Electronica Mozart FM Transmitter
Nieuwierzytelniony arbitrary file upload w DB Electronica Mozart FM Transmitter
RCE przez brak walidacji pliku firmware w DB Electronica Mozart FM Transmitter
RCE w nadajnikach FM DB Electronica — brak filtrowania danych wejściowych