CVE 9.2 CRITICAL

Unauthenticated Arbitrary File Deletion (patch_contents.php)_CVE-2025-66257

November 25, 2025 invoker category_cve

9.2 / 10

CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N

Description

Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files.
The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.

AI Analysis

Unauthenticated arbitrary file deletion vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter, allowing attackers to delete files without authentication or access control checks.

Basic Information

ID CVE-2025-66257

Source Gridware

Published Nov 26, 2025 at 00:43

Affected Product

Vendor DB Electronica Telecomunicazioni S.p.A.

Product Mozart FM Transmitter

Version 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 30
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 50
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 100
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 300
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 500
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 1000
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 2000
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 3000
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 3500
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 6000
DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 7000

CWE Classification

CWE-73

AI Assessment

AI Score 9.2 / 10

AI Severity Critical

Vendor DB Electronica Telecomunicazioni S.p.A.

Product Mozart FM Transmitter

Version 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000

References

www.abdulmhsblog.com /posts/webfmvulns/

{
    "lastseen": "",
    "description": "Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files.\nThe `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.",
    "published": "2025-11-26T00:43:54.408Z",
    "modified": "2025-11-26T00:43:54.408Z",
    "type": "cve",
    "title": "Unauthenticated Arbitrary File Deletion (patch_contents.php)",
    "source": "Gridware",
    "references": "https://www.abdulmhsblog.com/posts/webfmvulns/",
    "id": "CVE-2025-66257",
    "bulletinFamily": "",
    "cwe": [
        "CWE-73"
    ],
    "cvelist": null,
    "sourceData": "DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 30\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 50\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 100\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 300\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 500\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 1000\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 2000\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 3000\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 3500\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 6000\nDB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter 7000",
    "sourceHref": "",
    "cvss": {
        "score": 9.2,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Mozart FM Transmitter",
    "version": "30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000",
    "vendor": "DB Electronica Telecomunicazioni S.p.A.",
    "ai_description": "Unauthenticated arbitrary file deletion vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter, allowing attackers to delete files without authentication or access control checks.",
    "ai_severity": "Critical",
    "ai_vendor": "DB Electronica Telecomunicazioni S.p.A.",
    "ai_product": "Mozart FM Transmitter",
    "ai_version": "30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000",
    "ai_score": 9.2
}

💭 Join the Security Discussion ❌ Cancel Reply