External risk intelligence

Mozart FM Transmitter Arbitrary File Deletion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2025-66257

The affected devices are FM transmitters, which are typically managed via web-based interfaces. While these interfaces may be reachable over a network, they are generally intended for internal facility management or operational control rather than being exposed directly to the public internet as a primary design requirement. Public internet exposure is possible in some configurations but is not the standard or intended deployment model.

Dbbroadcast Mozart Next 100 Firmware

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the web interface of certain DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices. This issue allows unauthenticated remote attackers to delete arbitrary files on the affected devices, potentially disrupting operations. The main concern is confirming relevance and exposure of these devices within the environment.

Allows remote file deletion without authentication.
Crucial for operational integrity of FM transmitters.
Verify if FM transmitters are in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the affected device's web interface. The `patch_contents.php` script contains a `deletepatch` parameter that allows for the unauthenticated deletion of arbitrary files within the `/var/www/patch/` directory. This lack of sanitization and access control enables an attacker to remove critical files, potentially leading to a denial-of-service condition or further system compromise.

Unauthenticated network access required.
Exploits `deletepatch` parameter in `patch_contents.php`.
Allows arbitrary file deletion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to delete arbitrary files from the `/var/www/patch/` directory on affected FM transmitter devices. This is possible because the `deletepatch` parameter in `patch_contents.php` does not perform sufficient sanitization or access control checks. The specific files that could be deleted are not detailed in the advisory, nor is the impact on the transmitter's service behavior or any sensitive information it might store.

System files in `/var/www/patch/` could be deleted.
Unauthenticated access to `patch_contents.php`.
Disruption of transmitter service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated arbitrary file deletion vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices impacts systems that manage these devices, likely requiring coordination between infrastructure or platform teams responsible for the devices' network presence and the application owners who rely on their operational integrity. The first practical step is to identify all instances of the affected transmitters, determine their network reachability and business criticality, and then engage the accountable owners to plan remediation.

Infrastructure or platform teams own the issue.
Verify device reachability and criticality.
Coordinate vendor engagement for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is a DB Electronica Mozart FM Transmitter?

These are specialized hardware units used for broadcasting FM radio signals. They include integrated web-based management interfaces that allow administrators to configure transmitter settings and manage system firmware or patch files remotely.

What is the security weakness in CVE-2025-66257?

This vulnerability is classified as CWE-73, an external control of file name or path. Specifically, the web interface fails to verify if a user is authorized or if the requested file path is safe, allowing unauthenticated commands to delete arbitrary files from the system.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specifically crafted request to the patch_contents.php script on the transmitter using the deletepatch parameter. This does not require any login credentials; however, it is limited to files accessible within the /var/www/patch/ directory.

Do I need to worry if my transmitter is internal?

According to Halo Surface Signal, these devices are typically designed for internal operational control, but internet exposure is possible. While internal placement reduces risk, you should verify if any transmitters are reachable from outside your protected network perimeter.

What is the first step to address CVE-2025-66257?

Start by identifying all Mozart FM Transmitter units in your environment. Once identified, evaluate their network accessibility to confirm if they are exposed, and coordinate with the teams managing these devices to determine the vendor's recommended remediation steps.

References

www.abdulmhsblog.com/posts/webfmvulns/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.