CVE-2025-66250CWE-434unrestricted-file-upload

CVE-2025-66250

Critical · published November 26, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

🚨 An uncensored file upload vulnerability opens a door wide for attackers on multiple Mozart FM Transmitter versions! 🔥 Think of it like a kitchen where anyone can sneak in and toss in any ingredient without checking—one unguarded delivery could spoil the whole feast! An attacker could upload malicious files, which may then be executed, potentially leading to unauthorized access or further exploitation in your network. This could result in data leaks, system corruption, or even a full takeover of your devices—an absolute disaster waiting to happen!

Put simply

Think of it like a kitchen where anyone can sneak in and toss in any ingredient without checking—one unguarded delivery could spoil the whole feast! The flaw resides in the 'status_contents.php' file, which allows unauthenticated users to upload any file. Since the system does not validate the file type or check permissions, this opens the door for arbitrary code execution.

What to do

An attacker could upload malicious files, which may then be executed, potentially leading to unauthorized access or further exploitation in your network. This could result in data leaks, system corruption, or even a full takeover of your devices—an absolute disaster waiting to happen! Immediately patch to the latest version of Mozart FM Transmitter to safeguard against this vulnerability. Implement strict file validation checks in your code to ensure only permitted file types can be uploaded. Regularly review server configurations and monitor for suspicious file uploads. You've got this! With these steps, you'll fortify your defenses and keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-11-26T06:16Z
Affected products (22)
ProductVersionsFixed in
dbbroadcast/mozart_next_100_firmwareall versions—
dbbroadcast/mozart_next_1000_firmwareall versions—
dbbroadcast/mozart_next_2000_firmwareall versions—
dbbroadcast/mozart_next_30_firmwareall versions—
dbbroadcast/mozart_next_300_firmwareall versions—
dbbroadcast/mozart_next_3000_firmwareall versions—
dbbroadcast/mozart_next_3500_firmwareall versions—
dbbroadcast/mozart_next_50_firmwareall versions—
dbbroadcast/mozart_next_500_firmwareall versions—
dbbroadcast/mozart_next_6000_firmwareall versions—
dbbroadcast/mozart_next_7000_firmwareall versions—
dbbroadcast/mozart_dds_next_30_firmwareall versions—
dbbroadcast/mozart_dds_next_50_firmwareall versions—
dbbroadcast/mozart_dds_next_100_firmwareall versions—
dbbroadcast/mozart_dds_next_300_firmwareall versions—
dbbroadcast/mozart_dds_next_500_firmwareall versions—
dbbroadcast/mozart_dds_next_1000_firmwareall versions—
dbbroadcast/mozart_dds_next_2000_firmwareall versions—
dbbroadcast/mozart_dds_next_3000_firmwareall versions—
dbbroadcast/mozart_dds_next_3500_firmwareall versions—
dbbroadcast/mozart_dds_next_6000_firmwareall versions—
dbbroadcast/mozart_dds_next_7000_firmwareall versions—
References (1)
EPSS history
Timeline
  • 26 NOV 00:29Z
    Unauthenticated Arbitrary File Upload (status_contents.php)
    cvelistv5