Critical · published November 26, 2025
🚨 A shocking oversight: an unauthenticated OS Command Injection in DB Electronica's Mozart FM Transmitter could let attackers execute arbitrary shell commands! 🔥 Picture your favorite restaurant where anyone can just walk into the kitchen and start cooking without anyone checking their credentials — that’s the equivalent of how dangerously open this vulnerability is! 🍽️ An attacker could waltz right in and execute any command as the web server user, potentially compromising the entire system. This could lead to unauthorized access, data manipulation, or even a complete takeover of the transmitter services. The fallout could be absolutely devastating for operations!
Picture your favorite restaurant where anyone can just walk into the kitchen and start cooking without anyone checking their credentials — that’s the equivalent of how dangerously open this vulnerability is! 🍽️ This vulnerability arises from user input being passed directly to the `exec()` function in `start_upgrade.php` without any validation or escaping, allowing attackers to leverage metacharacters for command injection.
An attacker could waltz right in and execute any command as the web server user, potentially compromising the entire system. This could lead to unauthorized access, data manipulation, or even a complete takeover of the transmitter services. The fallout could be absolutely devastating for operations! Immediately patch this vulnerability by upgrading to the latest version of the Mozart FM Transmitter. Ensure that user input is properly sanitized and consider implementing stronger access controls to prevent unauthenticated access to sensitive endpoints. 🛡️ You've got this! Fixing it is just a few steps away, and you’ll be a security hero in no time! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| dbbroadcast/mozart_next_100_firmware | all versions | — |
| dbbroadcast/mozart_next_1000_firmware | all versions | — |
| dbbroadcast/mozart_next_2000_firmware | all versions | — |
| dbbroadcast/mozart_next_30_firmware | all versions | — |
| dbbroadcast/mozart_next_300_firmware | all versions | — |
| dbbroadcast/mozart_next_3000_firmware | all versions | — |
| dbbroadcast/mozart_next_3500_firmware | all versions | — |
| dbbroadcast/mozart_next_50_firmware | all versions | — |
| dbbroadcast/mozart_next_500_firmware | all versions | — |
| dbbroadcast/mozart_next_6000_firmware | all versions | — |
| dbbroadcast/mozart_next_7000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_30_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_50_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_100_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_300_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_500_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_1000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_2000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_3000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_3500_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_6000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_7000_firmware | all versions | — |