Strix
26.1K

CVE-2025-66256

CRITICALCVSS 9.9/10EPSS 0.38%

Last modified

CVE-2025-66256 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.

Description

Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0
9.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.38%

30.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
DbbroadcastMozart Next 100 FirmwareAll versions
DbbroadcastMozart Next 1000 FirmwareAll versions
DbbroadcastMozart Next 2000 FirmwareAll versions
DbbroadcastMozart Next 30 FirmwareAll versions
DbbroadcastMozart Next 300 FirmwareAll versions
DbbroadcastMozart Next 3000 FirmwareAll versions
DbbroadcastMozart Next 3500 FirmwareAll versions
DbbroadcastMozart Next 50 FirmwareAll versions
DbbroadcastMozart Next 500 FirmwareAll versions
DbbroadcastMozart Next 6000 FirmwareAll versions
DbbroadcastMozart Next 7000 FirmwareAll versions
DbbroadcastMozart Dds Next 30 FirmwareAll versions
DbbroadcastMozart Dds Next 50 FirmwareAll versions
DbbroadcastMozart Dds Next 100 FirmwareAll versions
DbbroadcastMozart Dds Next 300 FirmwareAll versions
DbbroadcastMozart Dds Next 500 FirmwareAll versions
DbbroadcastMozart Dds Next 1000 FirmwareAll versions
DbbroadcastMozart Dds Next 2000 FirmwareAll versions
DbbroadcastMozart Dds Next 3000 FirmwareAll versions
DbbroadcastMozart Dds Next 3500 FirmwareAll versions
DbbroadcastMozart Dds Next 6000 FirmwareAll versions
DbbroadcastMozart Dds Next 7000 FirmwareAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2025-66256?
Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.
How severe is CVE-2025-66256?
CVE-2025-66256 has a CVSS score of 9.9/10 (CRITICAL severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.
How do I fix CVE-2025-66256?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-66256?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST