Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2025-66262 is a tar extraction path traversal on Mozart FM that overwrites system files. No fix is named, so isolate the interface and ask the vendor.
CVE-2025-66261 is unauthenticated command injection in restore_settings.php on Mozart FM. No fix is named, so isolate the interface and ask the vendor.
CVE-2025-66259 is a root command injection in main_ok.php on Mozart FM through date and time input. No fix is named, so isolate the interface.
CVE-2025-66257 is unauthenticated file deletion via the deletepatch parameter on Mozart FM. No fix is named, so isolate the interface and ask the vendor.
CVE-2025-66256 is an unauthenticated unrestricted file upload in patch_contents.php on the Mozart FM Transmitter. No fix is named; isolate the interface.
CVE-2025-66255 lets anyone upload unsigned firmware to the Mozart FM Transmitter. No fix is named, so isolate the interface and ask the vendor.
CVE-2025-66254 is unauthenticated file deletion via the deleteupgrade parameter on Mozart FM. No fix is named, so isolate the interface and ask the vendor.
CVE-2025-66253 is unauthenticated command injection in start_upgrade.php on Mozart FM. No fix is named, so isolate the interface and ask the vendor.
CVE-2025-66251 is an unauthenticated path traversal in Mozart FM that deletes arbitrary .tgz files. No fix is named, so isolate the interface now.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
