CVE-2025-66254
📋 TL;DR
This vulnerability allows unauthenticated attackers to delete arbitrary files from the /var/www/upload/ directory on affected Mozart FM Transmitters. Attackers can exploit the deleteupgrade parameter in upgrade_contents.php without any authentication, potentially removing critical system files. All users of DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 are affected.
💻 Affected Systems
- DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
📦 What is this software?
Mozart Dds Next 1000 Firmware by Dbbroadcast
Mozart Dds Next 2000 Firmware by Dbbroadcast
Mozart Dds Next 3000 Firmware by Dbbroadcast
Mozart Dds Next 3500 Firmware by Dbbroadcast
Mozart Dds Next 6000 Firmware by Dbbroadcast
Mozart Dds Next 7000 Firmware by Dbbroadcast
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, causing device bricking, service disruption, or enabling further attacks by removing security controls.
Likely Case
Service disruption through deletion of configuration files, web application files, or uploaded content, leading to downtime and operational impact.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external exploitation, though internal threats remain.
🎯 Exploit Status
Simple HTTP request manipulation required. No authentication needed. Weaponization is likely due to low complexity and high impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Contact vendor for updates. Consider implementing workarounds immediately.
🔧 Temporary Workarounds
Remove or Restrict Access to upgrade_contents.php
linuxDelete or move the vulnerable file, or implement strict access controls.
mv /var/www/upgrade_contents.php /var/www/upgrade_contents.php.disabled
chmod 000 /var/www/upgrade_contents.php
Implement Web Application Firewall Rules
allBlock requests containing deleteupgrade parameter or targeting upgrade_contents.php.
🧯 If You Can't Patch
- Isolate affected devices in a separate network segment with strict firewall rules blocking external access.
- Implement monitoring and alerting for file deletion attempts in /var/www/upload/ directory.
🔍 How to Verify
Check if Vulnerable:
Check if /var/www/upgrade_contents.php exists and contains deleteupgrade parameter handling without authentication. Test with controlled file deletion attempt.Check Version:
Check device web interface or system documentation for model/version information.Verify Fix Applied:
Verify upgrade_contents.php is removed, disabled, or patched. Test that file deletion via deleteupgrade parameter no longer works.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to upgrade_contents.php with deleteupgrade parameter
- File deletion events in /var/www/upload/ directory
Network Indicators:
- HTTP POST/GET requests containing deleteupgrade parameter
- Unusual traffic patterns to the device's web interface
SIEM Query:
source="web_logs" AND uri="/upgrade_contents.php" AND (param="deleteupgrade" OR body CONTAINS "deleteupgrade")