CVE-2025-66251
Published: 26 November 2025
Description
Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows path traversal deletion of…
more
arbitrary .tgz files.
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the deletehidden parameter to block path traversal sequences, preventing arbitrary .tgz file deletion.
Prohibits unauthenticated actions like file deletion via the deletehidden parameter, requiring identification and authentication for sensitive operations.
Enforces approved access authorizations to system resources, preventing unauthorized path traversal and file deletion beyond restricted directories.
Security SummaryAI
CVE-2025-66251 is an unauthenticated path traversal vulnerability enabling arbitrary file deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter devices across versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, and 7000. The issue stems from the deletehidden parameter, which permits path traversal attacks to delete arbitrary .tgz files. It carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerability was published on 2025-11-26.
An unauthenticated attacker with network access to an affected device can exploit this vulnerability with low attack complexity and no user interaction. Exploitation involves manipulating the deletehidden parameter to traverse directories and target .tgz files for deletion, potentially disrupting device operations by causing high integrity and availability impacts, such as service denial or configuration loss.
Details on mitigation, including any patches or workarounds, are available in the referenced advisory at https://www.abdulmhsblog.com/posts/webfmvulns/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated path traversal enables exploitation of public-facing application (T1190) and arbitrary file deletion (T1070.004).