External risk intelligence

DB Electronica Mozart FM Transmitter Unauthenticated OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-66253

The vulnerability exists in a web-based endpoint (start_upgrade.php) of FM transmitter hardware. While these devices are specialized industrial/broadcast equipment often managed via internal networks, they may be exposed to the internet in some deployments for remote management, making reachability possible but not a standard or design-mandated requirement for general public access.

OS Command Injection

Dbbroadcast Mozart Next 100 Firmware

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in certain DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices, allowing unauthenticated attackers to execute arbitrary code remotely. This issue arises from improper handling of user input in a web-based upgrade script, posing a significant security risk if these devices are accessible over a network. The main concern is confirming relevance and exposure.

Attackers can run code remotely on affected devices.
Critical remote code execution vulnerability found.
Confirm relevance and potential network exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the `start_upgrade.php` endpoint. This endpoint processes user input for a "filename" parameter directly within an `exec()` function without proper validation or escaping. By including shell metacharacters in the filename, an attacker can inject and execute arbitrary operating system commands, leading to remote code execution with the privileges of the web server user, which is likely root.

No authentication required to initiate.
User-controlled input in `start_upgrade.php`.
Full command execution as web server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected devices. When the `start_upgrade.php` script is accessed with a specially crafted `filename` parameter, it may allow an attacker to bypass security controls and gain unauthorized access to the system. This could impact the device's intended functionality and potentially lead to further compromise, depending on the system's configuration and network exposure.

System commands and control.
Via crafted web requests to `start_upgrade.php`.
Device compromise or disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated OS command injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices likely falls under the purview of specialized industrial or broadcast equipment administrators, potentially overlapping with infrastructure and network security teams responsible for operational technology (OT) environments. The initial action should focus on discovering all deployed instances of the affected technology, assessing their network exposure and criticality, and then identifying the specific team or individual accountable for their management and remediation.

Own: Infrastructure or OT management teams.
Verify: Network exposure and asset criticality.
Act: Plan vendor-coordinated patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DB Electronica Mozart FM Transmitter?

These products are specialized radio frequency broadcast hardware used in telecommunications and broadcasting environments. They include various Mozart and Mozart DDS next-generation firmware models that manage FM transmission signals.

What does CVE-2025-66253 mean?

This is an OS Command Injection vulnerability (CWE-78). It means the device's software fails to filter user input correctly, allowing an attacker to insert and run their own unauthorized system commands directly on the hardware.

How is this vulnerability triggered?

An attacker triggers this by sending a web request to the start_upgrade.php file with a specially crafted filename parameter. Simply visiting the page without providing these malicious inputs, which include shell metacharacters like semicolons or pipes, will not trigger the command execution.

Is my device at risk?

Halo Surface Signal indicates the risk depends on your network setup. While these are specialized tools often kept on private networks, any instance configured with remote management access over the internet significantly increases the potential for unauthorized reachability.

What are the first steps for administrators?

Begin by creating an accurate inventory of all deployed Mozart FM Transmitter units. Assess each device to confirm its current network connectivity status—specifically whether it is reachable from external networks—and prioritize securing those exposed to the public internet.

References

www.abdulmhsblog.com/posts/webfmvulns/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.