← Back to browse · API

CVE-2025-66253

Severity
CRITICAL
CVSS
9.9
EPSS
0.02334
Risk score
40.42
CISA KEV
No
PoC
No
Published
2025-11-26
Modified
2025-12-03
First seen
2026-08-07
Aliases
EUVD-2025-199679, GHSA-998X-7989-C3GF
Products
DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 100, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 1000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 2000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 30, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 300, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 3000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 3500, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 50, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 500, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 6000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 7000
Sources
euvd EUVD-2025-199679

Description

Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).

References