Listen to this Post
The vulnerability exists in the `/var/tdf/patch_contents.php` endpoint of the device’s web interface. This script handles file uploads for system updates or content patches but performs no authentication checks, allowing any remote user to access it. It lacks any validation of the uploaded file’s type, extension, or MIME type, and imposes no meaningful restrictions beyond a generic 16MB size limit. An attacker can send a crafted HTTP POST request with a malicious file, such as a web shell with a `.php` extension, to this endpoint. The server will accept and save the file to a predictable or discoverable location on the filesystem. Once uploaded, the attacker can then directly request the malicious file, leading to arbitrary code execution with the privileges of the web server, typically root or a high-level system user, resulting in complete compromise of the transmitter device.
Platform: Mozart FM Transmitter
Version: 30,50,100,300,500,1000,2000,3000,3500,6000,7000
Vulnerability: Unauthenticated Arbitrary File Upload
Severity: Critical
Date: 2025-11-25
Prediction: 2026-Q1
What Undercode Say:
curl -X POST -F "[email protected]" http://<target>/var/tdf/patch_contents.php find / -name patch_contents.php 2>/dev/null strings /path/to/bin | grep -i "upload" ls -la /var/tdf/ cat /etc/passwd
How Exploit:
1. Identify target IP.
2. Craft HTTP POST request.
3. Upload web shell.
4. Execute commands via shell.
Protection from this CVE
- Restrict network access.
- Implement authentication.
- Validate file types.
- Apply vendor patch.
Impact:
- Remote Code Execution
- Full System Compromise
- Data Theft
- Device Takeover
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
