VulnerabilityAnalyzed
CVE-2025-66250
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A.
CRITICAL 9.2EPSS 0.44%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.
- CVSS 4.0
- 9.2 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.44% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- dbbroadcast/mozart next 100 firmware · dbbroadcast/mozart next 1000 firmware · dbbroadcast/mozart next 2000 firmware · dbbroadcast/mozart next 30 firmware · dbbroadcast/mozart next 300 firmware · dbbroadcast/mozart next 3000 firmware · dbbroadcast/mozart next 3500 firmware · dbbroadcast/mozart next 50 firmware · dbbroadcast/mozart next 500 firmware · dbbroadcast/mozart next 6000 firmware · dbbroadcast/mozart next 7000 firmware · dbbroadcast/mozart dds next 30 firmware · dbbroadcast/mozart dds next 50 firmware · dbbroadcast/mozart dds next 100 firmware · dbbroadcast/mozart dds next 300 firmware · dbbroadcast/mozart dds next 500 firmware · dbbroadcast/mozart dds next 1000 firmware · dbbroadcast/mozart dds next 2000 firmware · dbbroadcast/mozart dds next 3000 firmware · dbbroadcast/mozart dds next 3500 firmware · +2 more
- Source
- b7efe717-a805-47cf-8e9a-921fca0ce0ce
References
- https://www.abdulmhsblog.com/posts/webfmvulns/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.