CVE-2025-66259
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-03
Assigner: Gridware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dbbroadcast | mozart_next_100_firmware | * |
| dbbroadcast | mozart_next_100 | * |
| dbbroadcast | mozart_next_1000_firmware | * |
| dbbroadcast | mozart_next_1000 | * |
| dbbroadcast | mozart_next_2000_firmware | * |
| dbbroadcast | mozart_next_2000 | * |
| dbbroadcast | mozart_next_30_firmware | * |
| dbbroadcast | mozart_next_30 | * |
| dbbroadcast | mozart_next_300_firmware | * |
| dbbroadcast | mozart_next_300 | * |
| dbbroadcast | mozart_next_3000_firmware | * |
| dbbroadcast | mozart_next_3000 | * |
| dbbroadcast | mozart_next_3500_firmware | * |
| dbbroadcast | mozart_next_3500 | * |
| dbbroadcast | mozart_next_50_firmware | * |
| dbbroadcast | mozart_next_50 | * |
| dbbroadcast | mozart_next_500_firmware | * |
| dbbroadcast | mozart_next_500 | * |
| dbbroadcast | mozart_next_6000_firmware | * |
| dbbroadcast | mozart_next_6000 | * |
| dbbroadcast | mozart_next_7000_firmware | * |
| dbbroadcast | mozart_next_7000 | * |
| dbbroadcast | mozart_dds_next_30_firmware | * |
| dbbroadcast | mozart_dds_next_30 | * |
| dbbroadcast | mozart_dds_next_50_firmware | * |
| dbbroadcast | mozart_dds_next_50 | * |
| dbbroadcast | mozart_dds_next_100_firmware | * |
| dbbroadcast | mozart_dds_next_100 | * |
| dbbroadcast | mozart_dds_next_300_firmware | * |
| dbbroadcast | mozart_dds_next_300 | * |
| dbbroadcast | mozart_dds_next_500_firmware | * |
| dbbroadcast | mozart_dds_next_500 | * |
| dbbroadcast | mozart_dds_next_1000_firmware | * |
| dbbroadcast | mozart_dds_next_1000 | * |
| dbbroadcast | mozart_dds_next_2000_firmware | * |
| dbbroadcast | mozart_dds_next_2000 | * |
| dbbroadcast | mozart_dds_next_3000_firmware | * |
| dbbroadcast | mozart_dds_next_3000 | * |
| dbbroadcast | mozart_dds_next_3500_firmware | * |
| dbbroadcast | mozart_dds_next_3500 | * |
| dbbroadcast | mozart_dds_next_6000_firmware | * |
| dbbroadcast | mozart_dds_next_6000 | * |
| dbbroadcast | mozart_dds_next_7000_firmware | * |
| dbbroadcast | mozart_dds_next_7000 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authenticated root remote code execution in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices. It occurs because user input in the main_ok.php file, specifically data related to hour and time, is passed directly into a date shell command without proper filtering. This allows an attacker with authentication to execute arbitrary code with root privileges remotely.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary code with root privileges on the affected device remotely. This can lead to full system compromise, unauthorized control over the device, data theft, disruption of services, or use of the device as a pivot point for further attacks within a network.