CVE-2025-66255criticalCWE-345

CVE-2025-66255: critical vulnerability in DB Electronica Telecomunicazioni S.p.A.

Unauthenticated Arbitrary File Upload (upgrade_contents.php)

Published · Updated

Follow this CVE+ Monitor Mozart FM Transmitter

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 0.4%
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages.  The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N
Affected products
DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter
Related CVEs — DB Electronica Telecomunicazioni S.p.A.

In the same product, most dangerous first.

CVE-2025-66261CRITICALUnauthenticated OS Command Injection (restore_settings.php)EPSS 2.3%CVE-2025-66253CRITICALUnauthenticated OS Command Injection (start_upgrade.php)EPSS 2.3%CVE-2025-66262CRITICALArbitrary File Overwrite via Tar Extraction Path TraversalEPSS 1.5%CVE-2025-66259CRITICALAuthenticated Root Remote Code Execution through improper filtering of HTTP post request parametersEPSS 0.7%CVE-2025-66251HIGHUnauthenticated Path Traversal with Arbitrary File DeletionEPSS 0.5%CVE-2025-66256CRITICALUnauthenticated Arbitrary File Upload (patch_contents.php)EPSS 0.5%