BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-12-03

Assigner: Gridware

Description

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-26

Last Modified

2025-12-03

Generated

2026-07-06

AI Q&A

2025-11-26

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66250

Affected Vendors & Products

Vendor	Product	Version / Range
dbbroadcast	mozart_next_100_firmware	*
dbbroadcast	mozart_next_100	*
dbbroadcast	mozart_next_1000_firmware	*
dbbroadcast	mozart_next_1000	*
dbbroadcast	mozart_next_2000_firmware	*
dbbroadcast	mozart_next_2000	*
dbbroadcast	mozart_next_30_firmware	*
dbbroadcast	mozart_next_30	*
dbbroadcast	mozart_next_300_firmware	*
dbbroadcast	mozart_next_300	*
dbbroadcast	mozart_next_3000_firmware	*
dbbroadcast	mozart_next_3000	*
dbbroadcast	mozart_next_3500_firmware	*
dbbroadcast	mozart_next_3500	*
dbbroadcast	mozart_next_50_firmware	*
dbbroadcast	mozart_next_50	*
dbbroadcast	mozart_next_500_firmware	*
dbbroadcast	mozart_next_500	*
dbbroadcast	mozart_next_6000_firmware	*
dbbroadcast	mozart_next_6000	*
dbbroadcast	mozart_next_7000_firmware	*
dbbroadcast	mozart_next_7000	*
dbbroadcast	mozart_dds_next_30_firmware	*
dbbroadcast	mozart_dds_next_30	*
dbbroadcast	mozart_dds_next_50_firmware	*
dbbroadcast	mozart_dds_next_50	*
dbbroadcast	mozart_dds_next_100_firmware	*
dbbroadcast	mozart_dds_next_100	*
dbbroadcast	mozart_dds_next_300_firmware	*
dbbroadcast	mozart_dds_next_300	*
dbbroadcast	mozart_dds_next_500_firmware	*
dbbroadcast	mozart_dds_next_500	*
dbbroadcast	mozart_dds_next_1000_firmware	*
dbbroadcast	mozart_dds_next_1000	*
dbbroadcast	mozart_dds_next_2000_firmware	*
dbbroadcast	mozart_dds_next_2000	*
dbbroadcast	mozart_dds_next_3000_firmware	*
dbbroadcast	mozart_dds_next_3000	*
dbbroadcast	mozart_dds_next_3500_firmware	*
dbbroadcast	mozart_dds_next_3500	*
dbbroadcast	mozart_dds_next_6000_firmware	*
dbbroadcast	mozart_dds_next_6000	*
dbbroadcast	mozart_dds_next_7000_firmware	*
dbbroadcast	mozart_dds_next_7000	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated arbitrary file upload in the status_contents.php component of DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30 through 7000. It allows an attacker to upload files without authentication, potentially leading to unauthorized actions on the affected system.

Impact Analysis

The vulnerability can allow attackers to upload arbitrary files without authentication, which may lead to remote code execution, system compromise, data theft, or disruption of service, depending on the nature of the uploaded files and the system's configuration.

Hi! I’m here to help you understand CVE-2025-66250. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70