Critical · published November 26, 2025
🚨 An unauthenticated delete command can wipe any file in the patch directory! This means attackers can perform arbitrary file deletion on specific versions of DB Electronica's Mozart FM Transmitter. 🔥 Imagine a malicious visitor slipping through the front door of a restaurant and tossing out menus, specials, and even important documents without anyone noticing — that's what this vulnerability enables! An attacker could delete critical files, leading to complete chaos for the system's operations. This isn't just a little mess; it's a potentially devastating breach that can shut down services or corrupt essential data. The fallout could disrupt communications or render devices inoperable!
Imagine a malicious visitor slipping through the front door of a restaurant and tossing out menus, specials, and even important documents without anyone noticing — that's what this vulnerability enables! This unauthenticated arbitrary file deletion vulnerability in the `patch_contents.php` file allows attackers to use the `deletepatch` parameter to delete any file in the `/var/www/patch/` directory without any authentication or access control checks.
An attacker could delete critical files, leading to complete chaos for the system's operations. This isn't just a little mess; it's a potentially devastating breach that can shut down services or corrupt essential data. The fallout could disrupt communications or render devices inoperable! Immediately patch to the latest version of the Mozart FM Transmitter to remediate this issue. Review and restrict access rights to the `patch_contents.php` file, ensuring proper sanitization checks for incoming parameters. Conduct a thorough audit of the system to confirm no sensitive files have been affected. You've got this! Secure your systems and reclaim your peace of mind! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dbbroadcast/mozart_next_100_firmware | all versions | — |
| dbbroadcast/mozart_next_1000_firmware | all versions | — |
| dbbroadcast/mozart_next_2000_firmware | all versions | — |
| dbbroadcast/mozart_next_30_firmware | all versions | — |
| dbbroadcast/mozart_next_300_firmware | all versions | — |
| dbbroadcast/mozart_next_3000_firmware | all versions | — |
| dbbroadcast/mozart_next_3500_firmware | all versions | — |
| dbbroadcast/mozart_next_50_firmware | all versions | — |
| dbbroadcast/mozart_next_500_firmware | all versions | — |
| dbbroadcast/mozart_next_6000_firmware | all versions | — |
| dbbroadcast/mozart_next_7000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_30_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_50_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_100_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_300_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_500_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_1000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_2000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_3000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_3500_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_6000_firmware | all versions | — |
| dbbroadcast/mozart_dds_next_7000_firmware | all versions | — |