CVE-2025-66255
Unauthenticated Arbitrary File Upload (upgrade_contents.php)
- State
- Published
- Severity
- 9.9 Critical
- Published
- Nov 26, 2025
- Updated
- Dec 3, 2025
- Reserved
- Nov 26, 2025
Description
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.9 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N | Gridware |
Weaknesses
- CWE-345 Unauthenticated Arbitrary File Upload (upgrade_contents.php)
Affected Products
| Product | Versions |
|---|---|
Mozart FM TransmitterDB Electronica Telecomunicazioni S.p.A. |
|
References
- https://www.abdulmhsblog.com/posts/webfmvulns/exploittechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.