Critical · published November 26, 2025
🚨 An unauthenticated file upload vulnerability in Mozart FM Transmitter is a game-changer for attackers! 🔥 Think of the `upgrade_contents.php` endpoint as a front desk at a hotel that doesn’t check IDs when guests bring in ‘special packages’ — anyone can stroll in with anything, including harmful surprises! An attacker could upload harmful firmware, turning the transmitter into a puppet on a string, potentially leading to remote code execution. This could disrupt operations, steal sensitive information, or even allow the attacker to manipulate the device completely! Yikes!
Think of the `upgrade_contents.php` endpoint as a front desk at a hotel that doesn’t check IDs when guests bring in ‘special packages’ — anyone can stroll in with anything, including harmful surprises! This critical vulnerability allows unauthenticated file uploads, lacking proper validation for file types and signatures. As a result, malicious files can be injected and executed on the system, wreaking havoc.
An attacker could upload harmful firmware, turning the transmitter into a puppet on a string, potentially leading to remote code execution. This could disrupt operations, steal sensitive information, or even allow the attacker to manipulate the device completely! Yikes! Immediately patch to the latest version of the Mozart FM Transmitter firmware to close this vulnerability. Implement file validation checks to ensure that only properly signed and formatted files are accepted. Create a security policy for file uploads to prevent future incidents. You've got this! With these steps, you'll be on track to secure the system in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dbbroadcast/mozart_next_3000_firmware | all versions | — |
| dbbroadcast/mozart_next_3500_firmware | all versions | — |
| dbbroadcast/mozart_next_50_firmware | all versions | — |
| dbbroadcast/mozart_next_500_firmware | all versions | — |
| dbbroadcast/mozart_next_6000_firmware | all versions | — |
| dbbroadcast/mozart_next_7000_firmware | all versions | — |
| dbbroadcast/mozart_next_100_firmware | all versions | — |
| dbbroadcast/mozart_next_1000_firmware | all versions | — |
| dbbroadcast/mozart_next_2000_firmware | all versions | — |
| dbbroadcast/mozart_next_30_firmware | all versions | — |
| dbbroadcast/mozart_next_300_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_30_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_50_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_100_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_300_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_500_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_1000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_2000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_3000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_3500_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_6000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_7000_firmware | all versions | — |