BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-12-03

Assigner: Gridware

Description

Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fails in status_contents.php causing DoS. Due to the fact that the unlink operation is done in a while loop; if an immutable file is specified or otherwise a file in which the process has no permissions to delete; it would repeatedly attempt to do in a loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-26

Last Modified

2025-12-03

Generated

2026-07-06

AI Q&A

2025-11-26

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66252

Affected Vendors & Products

Vendor	Product	Version / Range
dbbroadcast	mozart_next_100_firmware	*
dbbroadcast	mozart_next_100	*
dbbroadcast	mozart_next_1000_firmware	*
dbbroadcast	mozart_next_1000	*
dbbroadcast	mozart_next_2000_firmware	*
dbbroadcast	mozart_next_2000	*
dbbroadcast	mozart_next_30_firmware	*
dbbroadcast	mozart_next_30	*
dbbroadcast	mozart_next_300_firmware	*
dbbroadcast	mozart_next_300	*
dbbroadcast	mozart_next_3000_firmware	*
dbbroadcast	mozart_next_3000	*
dbbroadcast	mozart_next_3500_firmware	*
dbbroadcast	mozart_next_3500	*
dbbroadcast	mozart_next_50_firmware	*
dbbroadcast	mozart_next_50	*
dbbroadcast	mozart_next_500_firmware	*
dbbroadcast	mozart_next_500	*
dbbroadcast	mozart_next_6000_firmware	*
dbbroadcast	mozart_next_6000	*
dbbroadcast	mozart_next_7000_firmware	*
dbbroadcast	mozart_next_7000	*
dbbroadcast	mozart_dds_next_30_firmware	*
dbbroadcast	mozart_dds_next_30	*
dbbroadcast	mozart_dds_next_50_firmware	*
dbbroadcast	mozart_dds_next_50	*
dbbroadcast	mozart_dds_next_100_firmware	*
dbbroadcast	mozart_dds_next_100	*
dbbroadcast	mozart_dds_next_300_firmware	*
dbbroadcast	mozart_dds_next_300	*
dbbroadcast	mozart_dds_next_500_firmware	*
dbbroadcast	mozart_dds_next_500	*
dbbroadcast	mozart_dds_next_1000_firmware	*
dbbroadcast	mozart_dds_next_1000	*
dbbroadcast	mozart_dds_next_2000_firmware	*
dbbroadcast	mozart_dds_next_2000	*
dbbroadcast	mozart_dds_next_3000_firmware	*
dbbroadcast	mozart_dds_next_3000	*
dbbroadcast	mozart_dds_next_3500_firmware	*
dbbroadcast	mozart_dds_next_3500	*
dbbroadcast	mozart_dds_next_6000_firmware	*
dbbroadcast	mozart_dds_next_6000	*
dbbroadcast	mozart_dds_next_7000_firmware	*
dbbroadcast	mozart_dds_next_7000	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is an Infinite Loop Denial of Service in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter software. It occurs in multiple versions when the unlink() function fails to delete a file in the status_contents.php script. Because the unlink operation is inside a while loop, if the file is immutable or the process lacks permission to delete it, the software repeatedly attempts deletion in an infinite loop, causing a denial of service.

Impact Analysis

The vulnerability can cause a denial of service (DoS) by making the affected software enter an infinite loop when attempting to delete certain files. This can lead to resource exhaustion, making the Mozart FM Transmitter software unresponsive or unavailable, potentially disrupting operations that depend on it.

Hi! I’m here to help you understand CVE-2025-66252. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70