CVE-2025-66259: falha crítica em DB Electronica Telecomunicazioni S.p.A.
Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.7%
Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php user supplied data/hour/time is passed directly into date shell command
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Produtos afetados
DB Electronica Telecomunicazioni S.p.A. · Mozart FM TransmitterCVEs relacionadas — DB Electronica Telecomunicazioni S.p.A.
No mesmo produto, das mais perigosas para as menos.
CVE-2025-66261CRITICALUnauthenticated OS Command Injection (restore_settings.php)EPSS 2.3%CVE-2025-66253CRITICALUnauthenticated OS Command Injection (start_upgrade.php)EPSS 2.3%CVE-2025-66262CRITICALArbitrary File Overwrite via Tar Extraction Path TraversalEPSS 1.5%CVE-2025-66251HIGHUnauthenticated Path Traversal with Arbitrary File DeletionEPSS 0.5%CVE-2025-66256CRITICALUnauthenticated Arbitrary File Upload (patch_contents.php)EPSS 0.5%CVE-2025-66250CRITICALUnauthenticated Arbitrary File Upload (status_contents.php)EPSS 0.5%