CVE-2025-66261

critical · 9.9

Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec() allows remote code execution. The `/var/tdf/restore_settings.php` endpoint passes user-controlled `$_GET["name"]` parameter through `urldecode()` directly into `exec()` without validation or escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, `&&`, etc.) to achieve unauthenticated remote code execution as the web server user.

9.9

CVSS

2.3%

EPSS (exploit prob.)

83rd

EPSS percentile

2025-11-26

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
dbbroadcast	mozart_next_100_firmware	all versions
dbbroadcast	mozart_next_100	all versions
dbbroadcast	mozart_next_1000_firmware	all versions
dbbroadcast	mozart_next_1000	all versions
dbbroadcast	mozart_next_2000_firmware	all versions
dbbroadcast	mozart_next_2000	all versions
dbbroadcast	mozart_next_30_firmware	all versions
dbbroadcast	mozart_next_30	all versions
dbbroadcast	mozart_next_300_firmware	all versions
dbbroadcast	mozart_next_300	all versions
dbbroadcast	mozart_next_3000_firmware	all versions
dbbroadcast	mozart_next_3000	all versions
dbbroadcast	mozart_next_3500_firmware	all versions
dbbroadcast	mozart_next_3500	all versions
dbbroadcast	mozart_next_50_firmware	all versions
dbbroadcast	mozart_next_50	all versions
dbbroadcast	mozart_next_500_firmware	all versions
dbbroadcast	mozart_next_500	all versions
dbbroadcast	mozart_next_6000_firmware	all versions
dbbroadcast	mozart_next_6000	all versions
dbbroadcast	mozart_next_7000_firmware	all versions
dbbroadcast	mozart_next_7000	all versions
dbbroadcast	mozart_dds_next_30_firmware	all versions
dbbroadcast	mozart_dds_next_30	all versions
dbbroadcast	mozart_dds_next_50_firmware	all versions
dbbroadcast	mozart_dds_next_50	all versions
dbbroadcast	mozart_dds_next_100_firmware	all versions
dbbroadcast	mozart_dds_next_100	all versions
dbbroadcast	mozart_dds_next_300_firmware	all versions
dbbroadcast	mozart_dds_next_300	all versions
dbbroadcast	mozart_dds_next_500_firmware	all versions
dbbroadcast	mozart_dds_next_500	all versions
dbbroadcast	mozart_dds_next_1000_firmware	all versions
dbbroadcast	mozart_dds_next_1000	all versions
dbbroadcast	mozart_dds_next_2000_firmware	all versions
dbbroadcast	mozart_dds_next_2000	all versions
dbbroadcast	mozart_dds_next_3000_firmware	all versions
dbbroadcast	mozart_dds_next_3000	all versions
dbbroadcast	mozart_dds_next_3500_firmware	all versions
dbbroadcast	mozart_dds_next_3500	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.abdulmhsblog.com/posts/webfmvulns/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-66261