Listen to this Post
How the CVE Works:
The vulnerability exists in the `status_contents.php` script located at `/var/tdf/` within the web interface of Mozart FM Transmitter devices. The script does not enforce any authentication checks, allowing direct, unauthenticated access. It contains flawed logic for handling file uploads, failing to validate user-supplied input such as file type, extension, or content. An attacker can send a crafted HTTP POST request with a malicious file (e.g., a webshell) to the vulnerable endpoint. The server accepts this request and writes the file contents to a predictable location on the filesystem. This grants the attacker the ability to upload arbitrary code, leading to full remote command execution with the privileges of the web server, typically root, as these are embedded devices.
Platform: DB Electronica Mozart FM Transmitter
Version: 30,50,100,300,500,1000,2000,3000,3500,6000,7000
Vulnerability: Arbitrary File Upload
Severity: Critical
Date: 11/25/2025
Prediction: Patch by 01/20/2026
What Undercode Say:
`$ curl -X POST -F “[email protected]” http://
``
How Exploit:
1. Identify target device.
2. Craft POST request.
3. Upload webshell payload.
4. Access uploaded shell.
5. Execute system commands.
Protection from this CVE
- Disable/remove
status_contents.php. - Implement strict authentication.
- Apply input validation.
- Restrict file permissions.
- Deploy network segmentation.
Impact:
- Remote Code Execution
- Full System Compromise
- Unauthorized Access
- Critical Infrastructure Risk
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
