PT-2025-48105 · Db Elettronica Telecomunicazioni Spa · Mozart Fm Transmitter

Abdul Mhanni

·

Published

2025-11-26

·

Updated

2025-11-28

·

CVE-2025-66253

CVSS v4.0
9.9
VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000
Description An unauthenticated OS Command Injection issue exists in the 
start upgrade.php
component of the software. The 
/var/tdf/start upgrade.php
API endpoint directly passes user-controlled input from the 
$ GET["filename"]
parameter to the 
exec()
function without proper sanitization or shell escaping. This allows attackers to inject arbitrary shell commands using metacharacters such as 
;
or 
|
to achieve remote code execution as the web server user, potentially with root privileges.
Recommendations Versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000 should be updated to a fixed version when available. As a temporary workaround, consider restricting access to the 
/var/tdf/start upgrade.php
endpoint. Alternatively, disable the 
start upgrade.php
functionality until a patch is available.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-66253

Affected Products

Mozart Fm Transmitter