Critical Β· published November 26, 2025
β‘ An unauthenticated path traversal vulnerability in DB Electronicaβs Mozart FM Transmitter lets attackers delete any .tgz file with a simple parameter change! π₯ Think of it like a janitor who can access every room in a building just by changing the sign on the door. If they don't need proper identification, they can toss out anything they want, including valuable files! An attacker could exploit this vulnerability to delete critical configuration files or sensitive data, leading to service disruptions or even a complete system breakdown. Imagine waking up to find essential files missing, and your operations grinding to a halt β absolutely devastating!
Think of it like a janitor who can access every room in a building just by changing the sign on the door. If they don't need proper identification, they can toss out anything they want, including valuable files! This vulnerability allows an attacker to manipulate the 'deletehidden' parameter in the application, resulting in path traversal that permits deletion of arbitrary .tgz files without authentication.
An attacker could exploit this vulnerability to delete critical configuration files or sensitive data, leading to service disruptions or even a complete system breakdown. Imagine waking up to find essential files missing, and your operations grinding to a halt β absolutely devastating! To safeguard against this, update your Mozart FM Transmitter to the latest patched version and ensure that proper authentication checks are implemented for file deletion requests. Regularly audit your configuration to mitigate risks! You've got this! With these steps, youβll fortify your defenses and keep your system running smoothly. π‘οΈ
| Product | Versions | Fixed in |
|---|---|---|
| dbbroadcast/mozart_next_100_firmware | all versions | β |
| dbbroadcast/mozart_next_1000_firmware | all versions | β |
| dbbroadcast/mozart_next_2000_firmware | all versions | β |
| dbbroadcast/mozart_next_30_firmware | all versions | β |
| dbbroadcast/mozart_next_300_firmware | all versions | β |
| dbbroadcast/mozart_next_3000_firmware | all versions | β |
| dbbroadcast/mozart_next_3500_firmware | all versions | β |
| dbbroadcast/mozart_next_50_firmware | all versions | β |
| dbbroadcast/mozart_next_500_firmware | all versions | β |
| dbbroadcast/mozart_next_6000_firmware | all versions | β |
| dbbroadcast/mozart_next_7000_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_30_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_50_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_100_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_300_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_500_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_1000_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_2000_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_3000_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_3500_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_6000_firmware | all versions | β |
| dbbroadcast/mozart_dds_next_7000_firmware | all versions | β |