External risk intelligence

DB Broadcast Mozart FM Transmitter OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-66261

The affected devices are FM transmitters. While these are specialized industrial or broadcast hardware typically managed through internal networks, web-based management interfaces for such appliances are sometimes exposed to wider networks or the internet in specific deployment scenarios, though public internet exposure is not a design requirement or a default state for this equipment.

OS Command Injection

Dbbroadcast Mozart Next 100 Firmware

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices, allowing unauthenticated remote code execution through a specific web endpoint. The flaw stems from improper handling of user input in the `restore_settings.php` script, enabling attackers to inject and execute arbitrary commands. While the primary concern is confirming relevance and exposure due to the specialized nature of the affected technology, the potential for unauthorized control warrants attention.

Allows unauthenticated remote code execution.
Focus on specialized broadcast technology.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the `restore_settings.php` endpoint. This endpoint processes a user-supplied `name` parameter without proper sanitization or validation. By URL-decoding this parameter and injecting shell metacharacters, an attacker can execute arbitrary commands on the server as the web server user. This could allow an attacker to compromise the system, potentially leading to further malicious activities.

No authentication required to access.
Triggered by sending crafted parameter to `restore_settings.php`.
Enables unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on affected devices. This could lead to unauthorized access and control over the system's functions and data when the `restore_settings.php` endpoint is accessible.

System commands and configuration could be affected.
Achieved via a specially crafted URL request.
Potential for unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated OS command injection vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices requires immediate attention from teams responsible for managing these broadcast or industrial control systems. The first practical step is to identify all instances of the affected technology, determine their network exposure and business criticality, and then locate the accountable owner for each instance to plan a risk-based remediation.

Application or infrastructure owners should lead remediation.
Verify network exposure and business criticality.
Coordinate vendor updates and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DB Electronica Mozart FM Transmitter?

The Mozart line, including Mozart Next and Mozart DDS Next models, consists of professional-grade FM broadcast transmitters. These devices are used by radio stations and communication providers to transmit FM signals. They include web-based management interfaces that allow administrators to configure transmitter settings and monitor performance remotely through a browser.

What does CWE-78 mean for CVE-2025-66261?

CWE-78 refers to OS Command Injection. In this CVE, the vulnerability occurs because the device's software fails to sanitize input in the restore_settings.php file. When a user provides a name parameter, the system passes it directly to an execution function. An attacker can use this weakness to inject hidden shell commands, which the device then runs with the privileges of the web server.

How is this command injection triggered?

An attacker triggers the vulnerability by sending a specially crafted web request to the restore_settings.php file on the device. By including malicious shell metacharacters—such as semicolons or pipes—within the 'name' parameter, the attacker forces the system to execute unauthorized instructions. The vulnerability does not require any prior authentication, meaning no login credentials are needed to initiate the attack.

Do I need to worry if my device is on an internal network?

Halo Surface Signal indicates that while these devices are designed for internal network management, they may be exposed to wider networks depending on your specific setup. If your transmitter's management interface is reachable from outside your local network, the risk is higher. You should assess whether the web interface is accessible beyond your trusted management environment.

What is the first step to address this CVE?

You should begin by performing an inventory of all Mozart transmitters in your environment to identify which specific models and versions are in use. Once identified, evaluate the network accessibility of each device's management interface. Finally, coordinate with the appropriate system owners to review your network security posture and plan for necessary firmware updates or configuration changes.

References

www.abdulmhsblog.com/posts/webfmvulns/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.