Critical ยท published November 26, 2025
โก An attacker can delete arbitrary files with just one malicious parameter! The `deleteupgrade` vulnerability in Mozart FM Transmitter is a heart-stopping oversight that allows unauthenticated file deletion like it's a walk in the park. ๐ฅ Think of a restaurant where anyone can walk into the kitchen and toss anything out without a second thought โ that's how this flaw operates. Here, an attacker can clear out critical system files without needing a key or an order of authority! If exploited, an attacker could wipe out essential files, potentially crippling the entire system. This could lead to service outages, loss of important data, and a chaotic scramble for recovery โ a nightmare scenario for anyone relying on these transmitters!
Think of a restaurant where anyone can walk into the kitchen and toss anything out without a second thought โ that's how this flaw operates. Here, an attacker can clear out critical system files without needing a key or an order of authority! The `deleteupgrade` parameter in `/var/www/upgrade_contents.php` allows unauthenticated access to delete any file in `/var/www/upload/`, without any restrictions on file types or paths, making the server dangerously vulnerable to file deletion attacks.
If exploited, an attacker could wipe out essential files, potentially crippling the entire system. This could lead to service outages, loss of important data, and a chaotic scramble for recovery โ a nightmare scenario for anyone relying on these transmitters! To remediate this vulnerability, immediately patch to the latest version or contact DB Electronica for an update. Additionally, implement strict access controls and validate parameters to prevent unauthorized file operations. Conduct a security audit to assess any potential impacts! You've got this! Follow these steps, and you'll tighten up security in no time. ๐ก๏ธ
| Product | Versions | Fixed in |
|---|---|---|
| dbbroadcast/mozart_next_100_firmware | all versions | โ |
| dbbroadcast/mozart_next_1000_firmware | all versions | โ |
| dbbroadcast/mozart_next_2000_firmware | all versions | โ |
| dbbroadcast/mozart_next_30_firmware | all versions | โ |
| dbbroadcast/mozart_next_300_firmware | all versions | โ |
| dbbroadcast/mozart_next_3000_firmware | all versions | โ |
| dbbroadcast/mozart_next_3500_firmware | all versions | โ |
| dbbroadcast/mozart_next_50_firmware | all versions | โ |
| dbbroadcast/mozart_next_500_firmware | all versions | โ |
| dbbroadcast/mozart_next_6000_firmware | all versions | โ |
| dbbroadcast/mozart_next_7000_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_30_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_50_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_100_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_300_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_500_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_1000_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_2000_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_3000_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_3500_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_6000_firmware | all versions | โ |
| dbbroadcast/mozart_dds_next_7000_firmware | all versions | โ |