Listen to this Post
How the CVE Works
The vulnerability resides in the `deletehidden` parameter of the Mozart FM Transmitter web interface. This parameter, accessible without authentication, does not properly sanitize user input. An attacker can craft a malicious HTTP GET request containing directory traversal sequences (e.g., ../../) within this parameter. The application concatenates this unsanitized input to a target directory path intended for deleting `.tgz` backup files. Because the server fails to validate the final resolved path, the attacker can escape the intended directory and point the deletion operation to any `.tgz` file accessible by the web server process. This leads to the unauthenticated, arbitrary deletion of critical system or application archive files, potentially causing a denial-of-service or impairing device functionality.
DailyCVE Form
Platform: Mozart FM Transmitter
Version: 30,50,100,300,500,1000,2000,3000,3500,6000,7000
Vulnerability: Path Traversal
Severity: Critical
Date: 2025-11-25
Prediction: Patch expected by 2025-12-25
What Undercode Say:
curl -X GET "http://<target>/path/to/endpoint?deletehidden=../../../etc/important.tgz"
for i in {1..10}; do curl -s "http://<target>/interface?deletehidden=../../../../tmp/backup$i.tgz"; done
How Exploit:
1. Attacker identifies target Mozart transmitter web interface.
- Sends crafted HTTP request with traversal in `deletehidden` parameter.
- Server processes request, resolves path, deletes specified `.tgz` file.
4. Attack succeeds without credentials.
Protection from this CVE
1. Apply vendor patch.
2. Implement input validation.
3. Use web application firewall.
Impact:
Arbitrary file deletion, system disruption, denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
