CRITICAL🇵🇱 Wersja polska

CVE-2025-66255

CVSS 9.9v4.0pub. 2025-11-26upd. 2025-12-03

Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages.  The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution

🤖 AI Analysis
How it works

The upgrade_contents.php endpoint responsible for firmware updates does not verify file headers, cryptographic signatures, or enforce .tgz format. Lack of authentication (CWE-345) combined with lack of verification of uploaded files (CWE-434) allows uploading any file, including a malicious firmware package. After uploading such a package, an attacker can gain the ability to execute code remotely on the device.

Impact

An attacker without any privileges can upload malicious firmware or any file, leading to complete takeover of the device and potential breach of confidentiality and integrity of data in the network to which the device is connected.

Mitigation & patch

Apply patches available from the manufacturer according to the references. Until the fix is implemented, it is recommended to isolate devices from public networks, restrict access to the management interface to trusted IP addresses only, and monitor traffic directed to the upgrade_contents.php endpoint.

Who is affected

DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter in versions: 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Dbbroadcast Mozart Dds Next 100

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 1000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 1000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 100 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 2000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 2000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 30

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 300

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 3000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 3000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 300 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 30 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 3500

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 3500 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 50

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 500

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 500 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 50 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 6000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 6000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 7000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Dds Next 7000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 100

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 1000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 1000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 100 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 2000

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 2000 Firmware

    OS
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 30

    HW
    Dbbroadcast
    all versions

  • Dbbroadcast Mozart Next 300

    HW
    Dbbroadcast
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2025-66257CRITICAL9.2PL ✓same product

Nieuwierzytelnione usuwanie plików w DB Electronica Mozart FM Transmitter

CVE-2025-66256CRITICAL9.9PL ✓same product

Nieuwierzytelniony arbitrary file upload w DB Electronica Mozart FM Transmitter

CVE-2025-66250CRITICAL9.2PL ✓same product

Nieuwierzytelniony arbitrary file upload w DB Electronica Mozart FM Transmitter

CVE-2025-66253CRITICAL9.9PL ✓same product

Nieuwierzytelniony OS Command Injection w DB Electronica Mozart FM Transmitter

CVE-2025-66259CRITICAL9.3PL ✓same product

RCE w nadajnikach FM DB Electronica — brak filtrowania danych wejściowych