CVE-2025-66250 is a critical (CVSS 9.8) unauthenticated arbitrary file upload in the DB Electronica Mozart FM Transmitter web interface, in status_contents.php. An attacker can place files on the device without logging in. No fixed version is named in the record, so isolate the management interface and contact the vendor.
What's affected
- Product: Mozart FM Transmitter from DB Electronica Telecomunicazioni S.p.A. (DB Broadcast), web management interface. The record lists models 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000 and 7000.
- Component: status_contents.php under /var/tdf, which accepts file uploads without a login.
- Fixed: neither the record nor the researcher write-up we read names a fixed firmware version or a vendor advisory. Contact the vendor for patch status before assuming one exists.
- Severity: the record scores it 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record and the write-up both treat it as serious. The write-up labels this one High in its own scale, while the record's CVSS 3.1 score is 9.8 (critical). The difference is just two scoring methods.
How to check if you're exposed
This is a broadcast appliance, so there is no package manager to query. Work from the device and the network.
- Build a list of every Mozart unit you run, with its model and the web interface version string. The researcher write-up refers to the web management interface version WEBMOZZI-00287.
- Find out whether the management web interface of each unit is reachable from the internet, from a partner network or from a flat internal network. Check firewall rules and any remote access gateway.
- Look at the web server logs on a device you can inspect, or at the logs of any proxy in front of it, for requests to the PHP file named in this CVE from addresses you do not recognize.
If the interface is reachable by people outside the small group that needs it, treat the device as exposed.
What to do now
- Take the management interface off the internet and off any shared network. Put it behind a VPN or a jump host, with an allow list of administrator addresses.
- Ask DB Broadcast for the patch status of this CVE and for a firmware version that fixes it. Record the answer with your asset notes.
- If you can, restrict access to this PHP path at a reverse proxy or firewall until the vendor provides a fix.
- Watch the device for unexpected files, new accounts, changed settings or reboots, and keep a known good copy of its configuration to compare against.
- Add the rest of your internet facing software to an inventory. Safeguard cannot patch a transmitter, but a free in-browser scan at gold.safeguard.sh/scan and a proper asset inventory help you find the other internet facing software you run, and reachability analysis helps you rank what to fix first.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The write-up explains that the endpoint checks the size of the upload but does not check the extension, the content type or the file header on the server. It describes a file extension check that exists only in the browser script, which means nothing on the server enforces it.
A client side check is a courtesy for honest users and offers no protection against someone sending requests directly. On a device that runs PHP, a file that lands in the wrong place can be executed, and the write-up connects this upload to other flaws in the same product, such as one that extracts uploaded archives at the root of the file system. The record does not mark this as exploited in the wild and it is not on the CISA KEV list. The advisory trail is thin, since the main public source is a researcher write-up rather than a vendor bulletin, so confirm facts with the vendor. Appliances of this kind sit for years without updates, which is why network isolation is the control you can apply today.
Quick check
Do attackers need to log in?
No. The record describes this as an unauthenticated upload.
Is there a patch?
No fixed version is named in the record or in the write-up we read. Ask the vendor.
Sources
- Researcher write-up: 14 vulnerabilities in the Mozart FM Transmitter web interface
- Safeguard Gold entry
Last reviewed: 18 October 2026.
