Overview
CVE-2025-66256 is a critical security vulnerability affecting DB Elettronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000. This vulnerability allows an unauthenticated attacker to upload arbitrary files to the system, potentially leading to remote code execution, system compromise, and other severe consequences.
Technical Details
The vulnerability resides in the /var/tdf/patch_contents.php endpoint. This endpoint lacks proper authentication and authorization mechanisms, allowing anyone with network access to the device to upload files. Furthermore, the endpoint does not implement adequate file type validation, MIME type checking, or file size restrictions (beyond a 16MB limit). This lack of security measures enables an attacker to upload malicious files, such as PHP scripts, executable files, or other dangerous content.
The specific issue lies in the absence of any checks on the uploaded file, enabling the attacker to bypass intended security measures. This can then be leveraged to execute arbitrary code and take control of the device.
CVSS Analysis
As of the publication date, a CVSS score is not available (N/A). However, given the nature of unauthenticated arbitrary file upload, and the potential for remote code execution, this vulnerability would likely receive a Critical severity rating once assessed. A high CVSS score in the 9.0-10.0 range would be expected.
Possible Impact
The impact of exploiting CVE-2025-66256 is significant. An attacker could:
- Gain remote code execution on the FM transmitter.
- Compromise the entire system and gain control over its functionalities.
- Upload malicious firmware updates.
- Disrupt broadcasting services.
- Use the compromised transmitter as a pivot point to attack other systems on the network.
- Steal sensitive information, including configuration files and credentials.
Mitigation and Patch Steps
To mitigate this vulnerability, it is crucial to take the following steps:
- Apply the official patch: Contact DB Elettronica Telecomunicazioni S.p.A. and request the patch for CVE-2025-66256. Apply the patch as soon as it becomes available.
- Implement Authentication: Immediately implement strong authentication and authorization mechanisms for the
/var/tdf/patch_contents.phpendpoint. Require users to log in with strong credentials before allowing file uploads. - Implement File Validation: Implement robust file type validation, MIME type checking, and file size restrictions. Only allow specific and necessary file types to be uploaded. Ensure to not rely on client-side validations alone.
- Network Segmentation: Isolate the FM transmitter on a separate network segment to limit the potential impact of a compromise.
- Web Application Firewall (WAF): Deploy a web application firewall (WAF) to monitor and filter malicious traffic attempting to exploit the vulnerability.
- Regular Security Audits: Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.
