Unauthenticated OS Command Injection (start_upgrade.php)

Description

Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).

Scores

EPSS (exploitation in 30 days)

2.3% · top 17% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.

Weakness

• CWE-78 Unauthenticated OS Command Injection (start_upgrade.php) (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter

  • affected 30
  • affected 50
  • affected 100
  • affected 300
  • affected 500
  • affected 1000
  • affected 2000
  • affected 3000
  • affected 3500
  • affected 6000
  • affected 7000

References (1)

• https://www.abdulmhsblog.com/posts/webfmvulns/ (opens in a new tab)exploittechnical-description

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-66253](https://trackcve.app/badge/CVE-2025-66253.svg)](https://trackcve.app/cve/CVE-2025-66253)

Record last updated 3 Dec 2025, 15:55 UTC.