Severity
CRITICAL
CVSS
9.9
EPSS
0.02334
Risk score
40.42
CISA KEV
No
PoC
No
Published
2025-11-26
Modified
2025-11-26
First seen
2026-08-07
Aliases
EUVD-2025-199672, GHSA-Q595-FCCR-C7X4
Products
DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 100, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 1000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 2000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 30, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 300, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 3000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 3500, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 50, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 500, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 6000, DB Electronica Telecomunicazioni S.p.A.:Mozart FM Transmitter 7000
Sources
Description
Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec() allows remote code execution.
The `/var/tdf/restore_settings.php` endpoint passes user-controlled `$_GET["name"]` parameter through `urldecode()` directly into `exec()` without validation or escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, `&&`, etc.) to achieve unauthenticated remote code execution as the web server user.