CVE-2025-66262
📋 TL;DR
This vulnerability allows attackers to overwrite arbitrary system files via path traversal in tar archive extraction. Attackers can craft malicious .tgz archives that, when processed by the vulnerable script, deposit files to the filesystem root, potentially overwriting critical files like /etc/shadow. All DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 are affected.
💻 Affected Systems
- DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter
📦 What is this software?
Mozart Dds Next 1000 Firmware by Dbbroadcast
Mozart Dds Next 2000 Firmware by Dbbroadcast
Mozart Dds Next 3000 Firmware by Dbbroadcast
Mozart Dds Next 3500 Firmware by Dbbroadcast
Mozart Dds Next 6000 Firmware by Dbbroadcast
Mozart Dds Next 7000 Firmware by Dbbroadcast
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via overwriting critical system files like /etc/shadow or /etc/passwd, allowing privilege escalation, persistence, and complete control of the device.
Likely Case
Service disruption, data corruption, or unauthorized access by overwriting configuration files, web content, or system binaries.
If Mitigated
Limited impact if file uploads are restricted and extraction occurs in isolated containers with proper permissions.
🎯 Exploit Status
Exploitation requires crafting malicious tar archives with path traversal filenames and uploading them via companion vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Contact vendor for security patches. 2. If patches unavailable, implement workarounds immediately. 3. Monitor vendor security advisories.
🔧 Temporary Workarounds
Disable vulnerable script
linuxRemove or disable execute permissions on restore_mozzi_memories.sh script
chmod -x /path/to/restore_mozzi_memories.sh
mv /path/to/restore_mozzi_memories.sh /path/to/restore_mozzi_memories.sh.disabled
Implement tar extraction validation
linuxModify script to validate tar archive contents before extraction
Modify restore_mozzi_memories.sh to include: tar -tf archive.tgz | grep -E '^\.\./' && echo 'Path traversal detected' || tar -xzf archive.tgz
🧯 If You Can't Patch
- Network segmentation: Isolate Mozart FM Transmitters from untrusted networks
- Access controls: Restrict file upload functionality to authenticated users only
🔍 How to Verify
Check if Vulnerable:
Check if restore_mozzi_memories.sh exists and contains tar extraction with -C / flag without path validationCheck Version:
Check device web interface or system information for model/versionVerify Fix Applied:
Verify script has been modified to validate tar archive paths or has been disabled📡 Detection & Monitoring
Log Indicators:
- Unusual tar extraction activity
- File modification in system directories
- Failed file upload attempts
Network Indicators:
- HTTP POST requests with .tgz file uploads to vulnerable endpoints
- Unusual outbound connections after exploitation
SIEM Query:
source="*mozart*" AND (event="file_upload" OR event="tar_extract") AND file_ext="tgz"