CVE-2025-66259CWE-20

CVE-2025-66259

Critical · published November 26, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

⚠️ A crafty input vulnerability in the DB Electronica Mozart FM Transmitter could let an authenticated attacker execute arbitrary commands on your system — like giving out the keys to a security room without checking who’s at the door! 🔥 Think of it like a restaurant kitchen where the chef accepts orders without checking the menu first. If someone suggests a dish that’s out of bounds, they can sneak in something dangerous without a second look! This vulnerability allows an attacker to run potentially harmful commands on the server, which could lead to data breaches, system manipulation, or worse! It’s absolutely devastating — once inside, they could tamper with critical system settings or access sensitive information.

Put simply

Think of it like a restaurant kitchen where the chef accepts orders without checking the menu first. If someone suggests a dish that’s out of bounds, they can sneak in something dangerous without a second look! In versions 30 through 7000 of the DB Electronica Mozart FM Transmitter, user input for date and time is not properly sanitized before being passed to the date shell command, leading to remote code execution under specific conditions.

What to do

This vulnerability allows an attacker to run potentially harmful commands on the server, which could lead to data breaches, system manipulation, or worse! It’s absolutely devastating — once inside, they could tamper with critical system settings or access sensitive information. To defend against this vulnerability, immediately patch to the latest version provided by DB Electronica. Enhance input validation to ensure that user-supplied data is thoroughly sanitized before execution. Regularly review your security policies to prevent similar issues in the future. You've got this! Implement these steps, and you’ll be one step closer to locking this vulnerability down. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00659 · 50.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-11-26T06:16Z
Affected products (22)
ProductVersionsFixed in
dbbroadcast/mozart_next_100_firmwareall versions—
dbbroadcast/mozart_next_1000_firmwareall versions—
dbbroadcast/mozart_next_2000_firmwareall versions—
dbbroadcast/mozart_next_30_firmwareall versions—
dbbroadcast/mozart_next_300_firmwareall versions—
dbbroadcast/mozart_next_3000_firmwareall versions—
dbbroadcast/mozart_next_3500_firmwareall versions—
dbbroadcast/mozart_next_50_firmwareall versions—
dbbroadcast/mozart_next_500_firmwareall versions—
dbbroadcast/mozart_next_6000_firmwareall versions—
dbbroadcast/mozart_next_7000_firmwareall versions—
dbbroadcast/mozart_dds_next_30_firmwareall versions—
dbbroadcast/mozart_dds_next_50_firmwareall versions—
dbbroadcast/mozart_dds_next_100_firmwareall versions—
dbbroadcast/mozart_dds_next_300_firmwareall versions—
dbbroadcast/mozart_dds_next_500_firmwareall versions—
dbbroadcast/mozart_dds_next_1000_firmwareall versions—
dbbroadcast/mozart_dds_next_2000_firmwareall versions—
dbbroadcast/mozart_dds_next_3000_firmwareall versions—
dbbroadcast/mozart_dds_next_3500_firmwareall versions—
dbbroadcast/mozart_dds_next_6000_firmwareall versions—
dbbroadcast/mozart_dds_next_7000_firmwareall versions—
References (1)
EPSS history
Timeline
  • 26 NOV 00:46Z
    Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters
    cvelistv5