CRITICAL🇵🇱 Wersja polska

CVE-2025-66256

CVSS 9.9v4.0pub. 2025-11-26upd. 2025-12-03

Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.

🤖 AI Analysis
How it works

The `/var/tdf/patch_contents.php` endpoint accepts file uploads without requiring authentication. No control mechanisms are implemented — there is no file type validation, no MIME header checking, and the only limitation is a file size limit of 16 MB. An attacker can upload any executable file (e.g., PHP webshell) directly over the network without needing any access credentials.

Impact

An attacker can gain remote control of the device by placing a malicious executable file (e.g., webshell), leading to complete system takeover, potential disruption of transmission, and the possibility of further attacks on broadcasting infrastructure.

Mitigation & patch

Patches available from the manufacturer should be applied according to the references. Until the patch is implemented, it is recommended to isolate devices from the public network, restrict access to the `/var/tdf/patch_contents.php` endpoint at the firewall or reverse proxy level, and monitor unauthorized requests to this endpoint.

Who is affected

DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter in versions: 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 (products from the Mozart Next and Mozart DDS Next lines).

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Dbbroadcast Mozart Dds Next 100

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 1000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 1000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 100 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 2000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 2000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 30

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 300

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 3000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 3000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 300 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 30 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 3500

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 3500 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 50

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 500

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 500 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 50 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 6000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 6000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 7000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Dds Next 7000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 100

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 1000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 1000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 100 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 2000

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 2000 Firmware

    OS
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 30

    HW
    Dbbroadcast
    wszystkie wersje

  • Dbbroadcast Mozart Next 300

    HW
    Dbbroadcast
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-66257CRITICAL9.2PL ✓ten sam produkt

Nieuwierzytelnione usuwanie plików w DB Electronica Mozart FM Transmitter

CVE-2025-66255CRITICAL9.9PL ✓ten sam produkt

RCE przez brak walidacji pliku firmware w DB Electronica Mozart FM Transmitter

CVE-2025-66250CRITICAL9.2PL ✓ten sam produkt

Nieuwierzytelniony arbitrary file upload w DB Electronica Mozart FM Transmitter

CVE-2025-66253CRITICAL9.9PL ✓ten sam produkt

Nieuwierzytelniony OS Command Injection w DB Electronica Mozart FM Transmitter

CVE-2025-66259CRITICAL9.3PL ✓ten sam produkt

RCE w nadajnikach FM DB Electronica — brak filtrowania danych wejściowych