CVE-2025-66259 - CVE House

Back to Database

Status published Critical CVE-2025-66259

Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters

9.3 CVSS

Vulnerability Description

Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php user supplied data/hour/time is passed directly into date shell command

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66259

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Abdul Mhanni

References

https://www.abdulmhsblog.com/posts/webfmvulns/

More from DB Electronica Telecomunicazioni S.p.A.

View All →

Unauthenticated Arbitrary File Read via Null Byte Injection

Arbitrary File Overwrite via Tar Extraction Path Traversal

Unauthenticated OS Command Injection (restore_settings.php)

PostgreSQL SQL Injection (status_sql.php)

Stored Cross-Site Scripting via XML Injection

Affected Vendor

DB Electronica Telecomunicazioni S.p.A.

View all reports →

Affected Software

Mozart FM Transmitter

Vulnerable Versions:

30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

Timeline

Official Publish: November 26th, 2025

Last Modified: November 26th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation