cR0w :cascadia: @cR0w@infosec.exchange
Public

Go hack more radio shit.

abdulmhsblog.com/posts/webfmvu

  • CVE-2025-66259: Authenticated Root RCE (main_ok.php)
  • CVE-2025-66253: Unauthenticated OS Command Injection (Upgrade)
  • CVE-2025-66261: Unauthenticated OS Command Injection (Restore)
  • CVE-2025-66262: Arbitrary File Overwrite (Tar Path Traversal)
  • CVE-2025-66250: Unrestricted File Upload (Status)
  • CVE-2025-66255: Unsigned Firmware Upload
  • CVE-2025-66256: Unrestricted Patch Upload
  • CVE-2025-66251: Path Traversal File Deletion
  • CVE-2025-66254: Arbitrary File Deletion (Upgrade)
  • CVE-2025-66263: Arbitrary File Read (Null Byte Injection)
  • CVE-2025-66260: SQL Injection
  • CVE-2025-66258: Stored XSS via XML Injection
  • CVE-2025-66257: Arbitrary Patch Deletion
  • CVE-2025-66252: Infinite Loop Denial of Service

14 Vulnerabilities in broadcasting system used by The United Nations, BBC Radio and others

Quick Intro As an electrical engineer with a passion for electronics, I have recently been reverse engineering and researching commonly deployed edge and IoT devices found in critical use environments. This research focuses on the Mozart FM Transmitter (web management interface version WEBMOZZI-00287), manufactured by DB Broadcast. I have discovered about 14 CVEs and likely more exist in the software as it is rather poorly made and its very concerning that the vendor supplies technology to major organizations like the United Nations, The BBC, CNBC and others.

abdulmhsblog.com · Abduls Blog

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://infosec.exchange/users/cR0w/statuses/115616705516119073 on your instance and quote it. (Note that quoting is not supported in Mastodon.)