Listen to this Post
The CVE-2025-66262 vulnerability operates through the `restore_mozzi_memories.sh` script in affected Mozart FM Transmitter devices. This script handles user-supplied tar archive files for system restoration purposes. It uses the `tar` command with the `-C /` flag, which changes the extraction directory to the root filesystem (/). The script does not validate or sanitize the file paths contained within the incoming tar archives. An attacker can craft a malicious .tgz archive that includes files with absolute paths (e.g., /etc/shadow) or directory traversal sequences (e.g., ../../var/www/index.php). When the script extracts this archive, the `-C /` flag causes these crafted paths to be resolved relative to the root directory, writing files directly to those specified locations. This allows overwriting of any critical system file that is writable by the process. The attack surface is increased by concurrent unauthenticated file upload vulnerabilities (CVE-01, CVE-06, CVE-07), enabling attackers to upload the malicious archive without credentials. Once uploaded, triggering the restoration script leads to arbitrary file overwrite, potentially replacing configuration files, binaries, or shadow passwords, resulting in full system compromise and remote code execution.
Platform: DB Electronica Mozart FM
Version: Various firmware versions
Vulnerability: Tar path traversal
Severity: Critical
Date: 11/25/2025
Prediction: Patch expected Q1 2026
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog
!/bin/bash
tar -czf exploit.tgz -P /etc/passwd
curl -F ‘[email protected]’ http://target/upload
How Exploit:
Craft malicious archive.
Upload via unauthenticated endpoint.
Trigger restore script.
Protection from this CVE:
Disable vulnerable script.
Apply vendor patch.
Validate archive paths.
Impact:
Full system compromise.
Arbitrary file overwrite.
Remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
