The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php endpoint. An attacker can exploit this by sending a crafted POST request with a malicious file (e.g., a PHP webshell) to the server. The uploaded file is stored in the /upload/ directory, enabling remote code execution and full system compromise.
CVE-2025-63228
CVSS base score
9.8 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-434
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
dbbroadcast mozart next 100 firmware
dbbroadcast mozart next 1000 firmware
dbbroadcast mozart next 2000 firmware
dbbroadcast mozart next 30 firmware
dbbroadcast mozart next 300 firmware
dbbroadcast mozart next 3000 firmware
dbbroadcast mozart next 3500 firmware
dbbroadcast mozart next 50 firmware
dbbroadcast mozart next 500 firmware
dbbroadcast mozart next 6000 firmware
References
- github.com Exploit, Third Party Advisory
- www.dbbroadcast.com Product