Listen to this Post
How CVE-2025-66254 works: The vulnerability exists in the `upgrade_contents.php` script of Mozart FM Transmitter devices. This PHP file is accessible via the web interface without authentication. It includes a parameter called `deleteupgrade` that triggers file deletion. The parameter value is directly used in a filesystem operation without validation. Attackers can send HTTP requests to `/var/www/upgrade_contents.php` with the `deleteupgrade` parameter. The parameter accepts arbitrary file paths, including directory traversal sequences. No input sanitization prevents escaping the intended `/var/www/upload/` directory. This allows deletion of files outside the restricted path. Critical system files can be targeted, such as configuration or executable files. The lack of authentication means any remote user can exploit this. The vulnerability likely uses the `unlink()` function in PHP. It does not check file extensions or implement path restrictions. Exploitation is simple via GET or POST requests. The affected devices include multiple hardware models with firmware versions. The code flaw reflects insecure direct object reference. It enables unauthenticated attackers to delete arbitrary files. This can lead to denial of service or system compromise. The vulnerability is network-exploitable without user interaction. Security researchers have identified the issue in public disclosures. Patches are needed to add authentication and input validation.
Platform: Mozart FM Transmitter
Version: Multiple affected versions
Vulnerability: Unauthenticated file deletion
Severity: Critical
Date: 11/25/2025
Prediction: Patch date TBA
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog
curl -X GET “http://target/upgrade_contents.php?deleteupgrade=../../../etc/passwd”
wget “http://target/upgrade_contents.php?deleteupgrade=../../var/www/html/index.php”
if(isset($_GET[‘deleteupgrade’])) { unlink($_GET[‘deleteupgrade’]); }
How Exploit:
Craft HTTP request. Use traversal sequences. No authentication needed.
Protection from this CVE:
Add authentication checks. Sanitize input paths. Restrict deletion directory.
Impact:
Denial of service. System file loss. Device compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
