CVE-2025-66250 - CVE House

Back to Database

Status published Critical CVE-2025-66250

Unauthenticated Arbitrary File Upload (status_contents.php)

9.2 CVSS

Vulnerability Description

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66250

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Abdul Mhanni

References

https://www.abdulmhsblog.com/posts/webfmvulns/

More from DB Electronica Telecomunicazioni S.p.A.

View All →

Unauthenticated Arbitrary File Read via Null Byte Injection

Arbitrary File Overwrite via Tar Extraction Path Traversal

Unauthenticated OS Command Injection (restore_settings.php)

PostgreSQL SQL Injection (status_sql.php)

Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters

Affected Vendor

DB Electronica Telecomunicazioni S.p.A.

View all reports →

Affected Software

Mozart FM Transmitter

Vulnerable Versions:

30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

Timeline

Official Publish: November 26th, 2025

Last Modified: November 26th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation