CVE-2025-66262
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-03
Assigner: Gridware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dbbroadcast | mozart_next_100_firmware | * |
| dbbroadcast | mozart_next_100 | * |
| dbbroadcast | mozart_next_1000_firmware | * |
| dbbroadcast | mozart_next_1000 | * |
| dbbroadcast | mozart_next_2000_firmware | * |
| dbbroadcast | mozart_next_2000 | * |
| dbbroadcast | mozart_next_30_firmware | * |
| dbbroadcast | mozart_next_30 | * |
| dbbroadcast | mozart_next_300_firmware | * |
| dbbroadcast | mozart_next_300 | * |
| dbbroadcast | mozart_next_3000_firmware | * |
| dbbroadcast | mozart_next_3000 | * |
| dbbroadcast | mozart_next_3500_firmware | * |
| dbbroadcast | mozart_next_3500 | * |
| dbbroadcast | mozart_next_50_firmware | * |
| dbbroadcast | mozart_next_50 | * |
| dbbroadcast | mozart_next_500_firmware | * |
| dbbroadcast | mozart_next_500 | * |
| dbbroadcast | mozart_next_6000_firmware | * |
| dbbroadcast | mozart_next_6000 | * |
| dbbroadcast | mozart_next_7000_firmware | * |
| dbbroadcast | mozart_next_7000 | * |
| dbbroadcast | mozart_dds_next_30_firmware | * |
| dbbroadcast | mozart_dds_next_30 | * |
| dbbroadcast | mozart_dds_next_50_firmware | * |
| dbbroadcast | mozart_dds_next_50 | * |
| dbbroadcast | mozart_dds_next_100_firmware | * |
| dbbroadcast | mozart_dds_next_100 | * |
| dbbroadcast | mozart_dds_next_300_firmware | * |
| dbbroadcast | mozart_dds_next_300 | * |
| dbbroadcast | mozart_dds_next_500_firmware | * |
| dbbroadcast | mozart_dds_next_500 | * |
| dbbroadcast | mozart_dds_next_1000_firmware | * |
| dbbroadcast | mozart_dds_next_1000 | * |
| dbbroadcast | mozart_dds_next_2000_firmware | * |
| dbbroadcast | mozart_dds_next_2000 | * |
| dbbroadcast | mozart_dds_next_3000_firmware | * |
| dbbroadcast | mozart_dds_next_3000 | * |
| dbbroadcast | mozart_dds_next_3500_firmware | * |
| dbbroadcast | mozart_dds_next_3500 | * |
| dbbroadcast | mozart_dds_next_6000_firmware | * |
| dbbroadcast | mozart_dds_next_6000 | * |
| dbbroadcast | mozart_dds_next_7000_firmware | * |
| dbbroadcast | mozart_dds_next_7000 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30 through 7000. The restore_mozzi_memories.sh script extracts user-controlled tar archives using the -C / flag, which causes the contents to be extracted to the filesystem root without validating the file paths. Attackers can exploit this by crafting malicious .tgz archives with path-traversed filenames (like etc/shadow or var/www/index.php) to overwrite critical system files, potentially leading to full system compromise.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to overwrite critical system files on the affected device, leading to full system compromise. Because the attacker can control the contents of the tar archive and the extraction path, they can replace important files such as password files or web server files, potentially gaining unauthorized access, executing arbitrary code, or disrupting system operations.