CVE-2025-66250

Critical

Published: 26/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An unauthenticated attacker can upload arbitrary files via /var/tdf/status_contents.php in Mozart FM Transmitters. This allows remote code execution or full device compromise.

Risk Assessment

Risk of complete takeover of the FM transmitter, potentially disrupting broadcasts or using the device for further network attacks.

Recommendation

Immediately restrict access to the mentioned endpoint and implement authentication and file validation. Contact the vendor for patches.

Original NVD description (English source)

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.