External risk intelligence

DB Broadcasting Mozart FM Transmitter Arbitrary File Overwrite via Tar Extraction Path Traversal

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-66262

The affected devices are FM transmitters, which are typically specialized industrial or broadcast hardware. While these devices may be managed via a web interface, they are generally deployed within dedicated broadcast infrastructure rather than exposed directly on the public internet by design. Therefore, while internet reachability is possible in some configurations, it is not a standard, intentional deployment pattern.

Path Traversal

Dbbroadcast Mozart Next 100 Firmware

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices, allowing an attacker to overwrite critical system files through a crafted archive. This could lead to a full system compromise.

Attackers can overwrite system files.
Critical infrastructure could be compromised.
Confirm relevance and scope of affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by first uploading a specially crafted archive to the system. The system's script then extracts this archive without proper path validation, allowing the attacker to overwrite critical system files. This, combined with other unauthenticated upload flaws, could lead to complete system compromise.

Requires unauthenticated file upload.
Triggered by tar extraction script.
Results in arbitrary file overwrite.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to overwrite critical system files on the affected devices, potentially leading to a full system compromise. This could occur when an attacker combines the arbitrary file overwrite capability with unauthenticated file upload vulnerabilities, allowing them to craft malicious archives that target sensitive files like system configurations or web server files.

System files and configurations at risk.
Via crafted archive and file upload.
Full system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects DB Electronic FM transmitters. Responsibility likely falls to infrastructure or platform teams managing these devices, in coordination with network and security teams. The immediate first step is to identify all deployed instances of the affected technology, confirm their network exposure and business criticality, and then assign an accountable owner for remediation planning.

Infrastructure and platform teams own remediation.
Verify device reachability and business criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DB Electronica Mozart FM Transmitter?

The Mozart series consists of specialized FM transmitter hardware manufactured by DB Electronica Telecomunicazioni S.p.A. These devices are utilized in radio broadcasting infrastructure to manage and transmit signals. The affected firmware versions govern the internal operations and management functions of these broadcast units.

How does CVE-2025-66262 allow file overwriting?

This vulnerability is classified as CWE-22, or Path Traversal. It occurs because a script on the device, designed to extract archive files, fails to validate file paths. By crafting a tar archive with specific directory-traversing filenames, an attacker can trick the system into placing files in protected, critical locations instead of the intended destination.

Can this vulnerability trigger without file uploading?

No. The vulnerability requires the presence of a maliciously crafted archive on the system to be processed by the flawed extraction script. While the script performs the dangerous action, it relies on a prerequisite step where the attacker successfully uploads the archive to the device using other existing vulnerabilities.

Is my Mozart device at risk if it is not on the internet?

According to Halo Surface Signal, these transmitters are typically used in specialized broadcast infrastructure. While internet-facing deployments are possible, they are not the standard design. If your device is isolated within an internal network, the risk is lower compared to one exposed to the public, though it remains a concern if local network security is breached.

What should I do first to manage this threat?

Begin by auditing your environment to locate all active Mozart transmitter units. Verify the specific firmware versions currently in use against the affected list. Once identified, evaluate the network accessibility of these devices and coordinate with your infrastructure team to prioritize the most critical or exposed units for security review.

References

www.abdulmhsblog.com/posts/webfmvulns/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.