CVE-2025-66256
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files to Mozart FM Transmitter devices via the patch_contents.php endpoint. Attackers can upload malicious files including webshells, leading to potential remote code execution. All Mozart FM Transmitter models versions 30 through 7000 are affected.
💻 Affected Systems
- DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
📦 What is this software?
Mozart Dds Next 1000 Firmware by Dbbroadcast
Mozart Dds Next 2000 Firmware by Dbbroadcast
Mozart Dds Next 3000 Firmware by Dbbroadcast
Mozart Dds Next 3500 Firmware by Dbbroadcast
Mozart Dds Next 6000 Firmware by Dbbroadcast
Mozart Dds Next 7000 Firmware by Dbbroadcast
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via webshell upload leading to remote code execution, data theft, device takeover, and lateral movement within the network.
Likely Case
Attackers upload webshells to gain persistent access, execute arbitrary commands, and potentially pivot to other network devices.
If Mitigated
With proper network segmentation and access controls, impact limited to the FM transmitter device itself.
🎯 Exploit Status
Simple HTTP POST request to upload files, no authentication or special conditions required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Contact vendor for updates and apply workarounds immediately.
🔧 Temporary Workarounds
Block patch_contents.php endpoint
linuxUse web server or firewall rules to block access to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "patch_contents.php" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "patch_contents.php" --algo bm -j DROP
Restrict network access
linuxPlace FM transmitters behind firewalls with strict inbound rules
iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j DROP
iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious file upload attempts to patch_contents.php
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file via POST to http://[device_ip]/var/tdf/patch_contents.phpCheck Version:
Check device web interface or contact vendor for version informationVerify Fix Applied:
Verify patch_contents.php endpoint returns 403/404 or file upload fails📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /var/tdf/patch_contents.php
- Unusual file uploads to transmitter device
Network Indicators:
- HTTP POST requests with file uploads to patch_contents.php endpoint
- Suspicious outbound connections from transmitter device
SIEM Query:
source="web_logs" AND uri="/var/tdf/patch_contents.php" AND method="POST"