PT-2025-48103 · Db Elettronica Telecomunicazioni Spa · Mozart Fm Transmitter

Abdul Mhanni · Published 2025-11-26 · Updated 2025-12-24 · CVE-2025-66251

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

Description An unauthenticated path traversal issue exists that allows for arbitrary file deletion. The deletehidden parameter enables path traversal, permitting the deletion of arbitrary .tgz files.

Recommendations Versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000 should be updated to a secure version. As a temporary workaround, restrict access to the deletehidden parameter.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-66251

Affected Products

Mozart Fm Transmitter

References · 8

• 🔥 https://abdulmhsblog.com/posts/webfmvulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66251 · Security Note
• https://t.me/cveNotify/144296 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993563167666938277 · Twitter Post
• https://twitter.com/dailycve/status/1996311095733100697 · Twitter Post
• https://t.me/CVEtracker/38242 · Telegram Post
• https://t.me/cveNotify/144041 · Telegram Post
• https://twitter.com/SecReportCVE/status/2003866687884415155 · Twitter Post