CVE-2025-66255
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload malicious firmware files to Mozart FM Transmitter devices, potentially leading to remote code execution. It affects all listed models (30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000) due to missing signature validation in the upgrade_contents.php endpoint.
💻 Affected Systems
- DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
📦 What is this software?
Mozart Dds Next 1000 Firmware by Dbbroadcast
Mozart Dds Next 2000 Firmware by Dbbroadcast
Mozart Dds Next 3000 Firmware by Dbbroadcast
Mozart Dds Next 3500 Firmware by Dbbroadcast
Mozart Dds Next 6000 Firmware by Dbbroadcast
Mozart Dds Next 7000 Firmware by Dbbroadcast
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with persistent backdoor installation, data exfiltration, and use as pivot point into internal networks.
Likely Case
Remote code execution leading to device takeover, service disruption, and potential lateral movement within the network.
If Mitigated
Limited impact if network segmentation prevents external access and strict firewall rules are in place.
🎯 Exploit Status
The vulnerability is well-documented with public technical details, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Contact DB Electronica Telecomunicazioni S.p.A. for firmware updates 2. Apply any available patches 3. Restart affected devices
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to the device's web interface and upgrade endpoint
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Endpoint Disablement
allDisable or remove the vulnerable upgrade_contents.php file if not needed
mv /path/to/upgrade_contents.php /path/to/upgrade_contents.php.disabled
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict firewall rules
- Implement network monitoring for unusual file upload attempts to the upgrade endpoint
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file to /upgrade_contents.php without authentication. If accepted, the device is vulnerable.Check Version:
Check device web interface or contact vendor for firmware version informationVerify Fix Applied:
Verify that file uploads to /upgrade_contents.php now require authentication and proper signature validation.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /upgrade_contents.php
- File uploads from unexpected IP addresses
- Firmware upgrade logs without proper authentication
Network Indicators:
- HTTP POST requests to /upgrade_contents.php from external IPs
- Large file transfers to the device on port 80
SIEM Query:
source="web_logs" AND uri="/upgrade_contents.php" AND method="POST" AND user_agent NOT IN ("legitimate_user_agents")