Overview
CVE-2025-66250 describes a critical unauthenticated arbitrary file upload vulnerability found in DB Elettronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000. This vulnerability allows a remote attacker to upload arbitrary files to the affected device without authentication. This could lead to severe consequences, including remote code execution and complete system compromise.
Technical Details
The vulnerability resides in the /var/tdf/status_contents.php script. The lack of authentication and input validation in this script allows an attacker to upload any type of file to the server. Exploitation is likely straightforward, involving a simple HTTP POST request to the vulnerable endpoint with the desired file content. The exact method for triggering the upload may depend on the specific configuration of the Mozart FM Transmitter.
CVSS Analysis
As of the published date (2025-11-26), a CVSS score is listed as “N/A”. However, given the nature of unauthenticated arbitrary file upload, a CVSS score reflecting “Critical” severity is highly probable once officially assessed. This is due to the high impact on confidentiality, integrity, and availability.
Possible Impact
The impact of CVE-2025-66250 is potentially severe:
- Remote Code Execution (RCE): An attacker could upload and execute malicious code on the device, gaining complete control.
- System Compromise: The attacker could compromise the entire FM transmitter system, potentially disrupting broadcasting operations.
- Data Breach: Sensitive data stored on the device could be accessed and exfiltrated.
- Denial of Service (DoS): The attacker could upload files that cause the system to crash or become unavailable.
- Malware Distribution: The compromised system could be used to distribute malware to other devices on the network or to broadcasting clients.
Mitigation and Patch Steps
Until an official patch is released by DB Elettronica Telecomunicazioni S.p.A., consider the following mitigation steps:
- Network Segmentation: Isolate the FM transmitter on a separate network segment to limit the potential impact of a successful attack.
- Access Control Lists (ACLs): Implement strict ACLs on the network to restrict access to the FM transmitter from untrusted sources.
- Web Application Firewall (WAF): Deploy a WAF to filter malicious requests targeting the
/var/tdf/status_contents.phpendpoint. - Monitor Network Traffic: Monitor network traffic for suspicious activity, such as unexpected file uploads or connections to known malicious IP addresses.
- Contact the Vendor: Immediately contact DB Elettronica Telecomunicazioni S.p.A. for information regarding a patch or workaround.
Important: Apply the official patch as soon as it becomes available.
