CVE-2025-66251CWE-22path-traversal

CVE-2025-66251

Critical Β· published November 26, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

⚑ An unauthenticated path traversal vulnerability in DB Electronica’s Mozart FM Transmitter lets attackers delete any .tgz file with a simple parameter change! πŸ”₯ Think of it like a janitor who can access every room in a building just by changing the sign on the door. If they don't need proper identification, they can toss out anything they want, including valuable files! An attacker could exploit this vulnerability to delete critical configuration files or sensitive data, leading to service disruptions or even a complete system breakdown. Imagine waking up to find essential files missing, and your operations grinding to a halt β€” absolutely devastating!

Put simply

Think of it like a janitor who can access every room in a building just by changing the sign on the door. If they don't need proper identification, they can toss out anything they want, including valuable files! This vulnerability allows an attacker to manipulate the 'deletehidden' parameter in the application, resulting in path traversal that permits deletion of arbitrary .tgz files without authentication.

What to do

An attacker could exploit this vulnerability to delete critical configuration files or sensitive data, leading to service disruptions or even a complete system breakdown. Imagine waking up to find essential files missing, and your operations grinding to a halt β€” absolutely devastating! To safeguard against this, update your Mozart FM Transmitter to the latest patched version and ensure that proper authentication checks are implemented for file deletion requests. Regularly audit your configuration to mitigate risks! You've got this! With these steps, you’ll fortify your defenses and keep your system running smoothly. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
9.1 Β· CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00487 Β· 41.0th percentile
Weakness
CWE-22 Β· Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-11-26T06:16Z
Affected products (22)
ProductVersionsFixed in
dbbroadcast/mozart_next_100_firmwareall versionsβ€”
dbbroadcast/mozart_next_1000_firmwareall versionsβ€”
dbbroadcast/mozart_next_2000_firmwareall versionsβ€”
dbbroadcast/mozart_next_30_firmwareall versionsβ€”
dbbroadcast/mozart_next_300_firmwareall versionsβ€”
dbbroadcast/mozart_next_3000_firmwareall versionsβ€”
dbbroadcast/mozart_next_3500_firmwareall versionsβ€”
dbbroadcast/mozart_next_50_firmwareall versionsβ€”
dbbroadcast/mozart_next_500_firmwareall versionsβ€”
dbbroadcast/mozart_next_6000_firmwareall versionsβ€”
dbbroadcast/mozart_next_7000_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_30_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_50_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_100_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_300_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_500_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_1000_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_2000_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_3000_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_3500_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_6000_firmwareall versionsβ€”
dbbroadcast/mozart_dds_next_7000_firmwareall versionsβ€”
References (1)
EPSS history
Timeline
  • 26 NOV 00:32Z
    Unauthenticated Path Traversal with Arbitrary File Deletion
    cvelistv5