CVE-2025-66257
📋 TL;DR
This vulnerability allows unauthenticated attackers to delete arbitrary files in the /var/www/patch/ directory of Mozart FM Transmitter devices. Attackers can exploit the deletepatch parameter in patch_contents.php without any authentication or access controls. All Mozart FM Transmitter models (30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000) are affected.
💻 Affected Systems
- DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
📦 What is this software?
Mozart Dds Next 1000 Firmware by Dbbroadcast
Mozart Dds Next 2000 Firmware by Dbbroadcast
Mozart Dds Next 3000 Firmware by Dbbroadcast
Mozart Dds Next 3500 Firmware by Dbbroadcast
Mozart Dds Next 6000 Firmware by Dbbroadcast
Mozart Dds Next 7000 Firmware by Dbbroadcast
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, rendering the device inoperable or enabling further attacks by removing security controls.
Likely Case
Service disruption by deleting configuration or operational files, potentially causing FM transmission outages or device malfunction.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the vulnerable endpoint.
🎯 Exploit Status
The vulnerability is straightforward to exploit - attackers simply need to send a crafted HTTP request with the deletepatch parameter pointing to target files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Contact DB Electronica Telecomunicazioni S.p.A. for security updates and patch availability.
🔧 Temporary Workarounds
Remove or Restrict Access to patch_contents.php
linuxDelete or rename the vulnerable patch_contents.php file to prevent exploitation.
mv /var/www/patch/patch_contents.php /var/www/patch/patch_contents.php.disabled
Implement Web Server Access Controls
linuxConfigure web server (Apache/Nginx) to block access to the patch_contents.php endpoint.
# Apache: Add to .htaccess or virtual host config
<Files "patch_contents.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /patch_contents\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FM transmitters from untrusted networks
- Deploy a web application firewall (WAF) with rules to block requests containing 'deletepatch' parameter
🔍 How to Verify
Check if Vulnerable:
Check if /var/www/patch/patch_contents.php exists and contains the deletepatch parameter without authentication checks. Test with: curl -X POST 'http://device-ip/patch/patch_contents.php' --data 'deletepatch=test.txt'Check Version:
Check device web interface or contact vendor for version informationVerify Fix Applied:
Verify patch_contents.php is removed/renamed or returns 403/404. Test exploitation attempts fail.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /patch/patch_contents.php
- Log entries showing file deletion in /var/www/patch/ directory
- Web server error logs showing 403/404 for patch_contents.php after remediation
Network Indicators:
- HTTP POST requests containing 'deletepatch' parameter
- Unusual traffic to FM transmitter web interfaces from external IPs
SIEM Query:
source="web_server_logs" AND (uri="/patch/patch_contents.php" OR uri="/patch_contents.php") AND method="POST" AND (param="deletepatch" OR body CONTAINS "deletepatch")