CVE-2025-66253
CriticalSummary
The start_upgrade.php endpoint passes user-controlled filename directly to exec() without sanitization. An unauthenticated attacker can inject arbitrary shell commands, achieving remote code execution as the web server user (likely root).
Risk Assessment
Risk of complete device compromise, potentially allowing full control over the transmitter and network.
Recommendation
Immediately secure the start_upgrade.php endpoint by sanitizing input and avoiding exec() with user data.
Other vulnerabilities in Mozart FM Transmitter
See all- CVE-2025-66255Critical
An unauthenticated attacker can upload arbitrary files to the upgrade_contents.php endpoint in Mozart FM Transmitter. Missing signature validation allows malicious firmware injection, potentially leading to remote code execution.
- CVE-2025-66254Critical
An unauthenticated attacker can use the deleteupgrade parameter in upgrade_contents.php to delete arbitrary files in /var/www/upload/ without extension or path sanitization, potentially removing critical system files.
- CVE-2025-66251Critical
An unauthenticated attacker can exploit the deletehidden parameter to perform path traversal and delete arbitrary .tgz files on the Mozart FM Transmitter.
- CVE-2025-66250Critical
An unauthenticated attacker can upload arbitrary files via /var/tdf/status_contents.php in Mozart FM Transmitters. This allows remote code execution or full device compromise.
- CVE-2025-63228Critical
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287 contains an unauthenticated file upload vulnerability in the /upload_file.php endpoint. An attacker can exploit this by sending a crafted POST request with a malicious file (e.g., a PHP webshell) to the server. The uploaded file is stored in the /upload/ directory, enabling remote code execution and full system compromise.
Original NVD description (English source)
Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).