Strix
26.1K

CVE-2025-66250

CRITICALCVSS 9.2/10EPSS 0.38%

Last modified

CVE-2025-66250 is a critical-severity vulnerability rated 9.2/10 on the CVSS scale. Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.

Description

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0
9.2/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.38%

30.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
DbbroadcastMozart Next 100 FirmwareAll versions
DbbroadcastMozart Next 1000 FirmwareAll versions
DbbroadcastMozart Next 2000 FirmwareAll versions
DbbroadcastMozart Next 30 FirmwareAll versions
DbbroadcastMozart Next 300 FirmwareAll versions
DbbroadcastMozart Next 3000 FirmwareAll versions
DbbroadcastMozart Next 3500 FirmwareAll versions
DbbroadcastMozart Next 50 FirmwareAll versions
DbbroadcastMozart Next 500 FirmwareAll versions
DbbroadcastMozart Next 6000 FirmwareAll versions
DbbroadcastMozart Next 7000 FirmwareAll versions
DbbroadcastMozart Dds Next 30 FirmwareAll versions
DbbroadcastMozart Dds Next 50 FirmwareAll versions
DbbroadcastMozart Dds Next 100 FirmwareAll versions
DbbroadcastMozart Dds Next 300 FirmwareAll versions
DbbroadcastMozart Dds Next 500 FirmwareAll versions
DbbroadcastMozart Dds Next 1000 FirmwareAll versions
DbbroadcastMozart Dds Next 2000 FirmwareAll versions
DbbroadcastMozart Dds Next 3000 FirmwareAll versions
DbbroadcastMozart Dds Next 3500 FirmwareAll versions
DbbroadcastMozart Dds Next 6000 FirmwareAll versions
DbbroadcastMozart Dds Next 7000 FirmwareAll versions

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-66250?
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.
How severe is CVE-2025-66250?
CVE-2025-66250 has a CVSS score of 9.2/10 (CRITICAL severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.
How do I fix CVE-2025-66250?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-66250?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST