External risk intelligence

Mozart FM Transmitter Unauthenticated File Upload Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63228

The vulnerability exists in a web management interface for FM transmitter hardware. While these devices are typically managed by administrators, such appliances often expose management interfaces to the network, and the vulnerability is directly reachable through an unauthenticated web endpoint, making it a likely target for exposure in operational environments where remote management is required.

Unrestricted File Upload

Dbbroadcast Mozart Next 100 Firmware

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the web management interface of certain FM transmitters, allowing unauthorized access and remote code execution on affected devices. This issue stems from an unauthenticated file upload flaw within the system's management portal.

Unauthenticated file upload vulnerability in FM transmitter management.
Critical access allows remote code execution and system compromise.
Confirm relevance and potential exposure of FM transmitter devices.

Attack Path

How an attacker could exploit the issue

An attacker can target the web management interface of the Mozart FM Transmitter to upload a malicious file without authentication. This is achieved by sending a specially crafted request to the `/upload_file.php` endpoint. Successful exploitation allows the attacker to store a webshell on the server, which can then be used to execute arbitrary code and potentially gain full control of the system.

No login required to start.
Upload a malicious file via a specific endpoint.
Full system compromise and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity and availability of the Mozart FM Transmitter's web management interface. When supported by the advisory, an unauthenticated attacker could upload a malicious file to the server, potentially leading to unauthorized code execution.

System data and service integrity at risk.
Malicious file uploaded via web interface.
Remote code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical unauthenticated file upload vulnerability affects the web management interface of Mozart FM Transmitters. Responsibility for addressing this likely falls to infrastructure or platform teams managing these devices, with initial actions focused on identifying all instances, assessing their network exposure and business criticality, and locating the accountable owner for remediation planning.

Own the issue: Infrastructure/Platform team.
Verify first: Device exposure and criticality.
Action: Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Mozart FM Transmitter?

The Mozart FM Transmitter is professional broadcast hardware used for radio transmission, covering various models like the Next and DDS Next series. These devices include an integrated web management interface that allows administrators to configure and control the equipment remotely.

What does CWE-434 mean for CVE-2025-63228?

CWE-434 refers to an Unrestricted Upload of File with Dangerous Type. In this CVE, the web interface fails to verify the content or type of files uploaded. Because the system accepts these files without authentication, an attacker can upload malicious scripts that the server may later execute.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specifically crafted HTTP POST request to the /upload_file.php endpoint on the device's web server. No authentication, login credentials, or prior access to the system are required to initiate this file upload process.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this is categorized as a likely risk because these FM transmitter management interfaces are often exposed to networks to facilitate remote administration. If your device's web management interface is reachable over the network, it is a potential target.

What are the first steps to address this issue?

Begin by identifying all Mozart FM Transmitter units in your environment. Assess whether their web management interfaces are accessible over the network and determine their business criticality. Once identified, locate the system owners to coordinate vendor updates or implement network-level access restrictions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.