External risk intelligence

DB Broadcast Mozart FM Transmitter File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-66255

This vulnerability affects FM broadcast transmitters, which are specialized industrial or broadcast infrastructure equipment. While they may have management interfaces, they are typically deployed within restricted or isolated operational networks rather than being directly exposed to the public internet.

Unrestricted File Upload

Dbbroadcast Mozart Next 3000 Firmware

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices, allowing unauthenticated attackers to upload malicious firmware. This could potentially lead to unauthorized code execution, impacting the integrity and availability of broadcast operations. The main concern is confirming the relevance and exposure of these specific devices within our infrastructure.

Unauthenticated firmware uploads are possible.
Critical for broadcast integrity and availability.
Confirm device relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a malicious firmware package through the upgrade endpoint without authentication. This bypasses security checks for file types and signatures, potentially leading to the execution of arbitrary code on the affected devices. The vulnerability exists in the `upgrade_contents.php` script, which handles firmware updates.

No authentication required for upload.
Malicious firmware uploaded to the device.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could upload malicious firmware to FM transmitters, potentially allowing them to execute arbitrary code. This occurs because the upgrade process in `upgrade_contents.php` does not properly validate uploaded files, signatures, or format, creating a pathway for unauthorized control.

FM transmitter firmware.
Uploading malicious firmware packages.
Gaining unauthorized control of devices.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing the DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter infrastructure should prioritize identifying all instances of this affected technology. The initial step involves confirming network reachability and assessing business criticality for each instance to accurately prioritize remediation efforts and engage the accountable owner.

Infrastructure or Operations teams own the issue.
Verify asset inventory and network exposure.
Plan coordinated vendor engagement for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DB Electronica Mozart FM Transmitter?

These devices are specialized hardware used by broadcast organizations to transmit FM radio signals. They are critical infrastructure components that rely on internal firmware to manage radio broadcasting operations and system configurations.

What does CVE-2025-66255 mean for system security?

This is an arbitrary file upload vulnerability. Specifically, it involves Improper Neutralization of Input During Web Page Generation (CWE-434) and Improper Validation of Integrity/Authenticity (CWE-345). Because the system fails to check if a firmware update is legitimate or properly formatted, an attacker can replace the device's software with malicious code.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by interacting with the `upgrade_contents.php` endpoint. Because the device does not require authentication or perform cryptographic signature checks, any file can be sent to the update mechanism. Simply attempting to upload a standard, non-malicious file will not trigger the execution, but sending a crafted, malicious package allows the system to accept it as a valid update.

Do I need to worry if my transmitter is not on the internet?

While the vulnerability is technically network-exploitable, Halo Surface Signal notes that these FM transmitters are typically deployed within restricted or isolated operational networks. If your device is segmented from the public internet, the practical risk is significantly lower than for publicly exposed equipment.

What are the first steps to manage this risk?

Begin by auditing your infrastructure to locate all instances of the affected Mozart FM models. Confirm the network location of each device to determine if it is reachable from untrusted zones. Once you have identified your assets, assess their operational criticality and coordinate with your vendor to obtain and apply the necessary firmware updates.

References

www.abdulmhsblog.com/posts/webfmvulns/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.