Kritik CVSS 9.8 PoC var
CVE-2025-63228: Mozart Next 100 Firmware: tehlikeli dosya yükleme
Açıklama (NVD)
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php endpoint. An attacker can exploit this by sending a crafted POST request with a malicious file (e.g., a PHP webshell) to the server. The uploaded file is stored in the /upload/ directory, enabling remote code execution and full system compromise.
Özet bilgiler
- Ürün
- Dbbroadcast Mozart Next 100 Firmware
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,82 (yüzdelik 57)
- CWE
- CWE-434
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| dbbroadcast-mozart-next-100-firmware | — | — | — |
| dbbroadcast-mozart-next-1000-firmware | — | — | — |
| dbbroadcast-mozart-next-2000-firmware | — | — | — |
| dbbroadcast-mozart-next-30-firmware | — | — | — |
| dbbroadcast-mozart-next-300-firmware | — | — | — |
| dbbroadcast-mozart-next-3000-firmware | — | — | — |
| dbbroadcast-mozart-next-3500-firmware | — | — | — |
| dbbroadcast-mozart-next-50-firmware | — | — | — |
| dbbroadcast-mozart-next-500-firmware | — | — | — |
| dbbroadcast-mozart-next-6000-firmware | — | — | — |
| dbbroadcast-mozart-next-7000-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-30-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-50-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-100-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-300-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-500-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-1000-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-2000-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-3000-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-3500-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-6000-firmware | — | — | — |
| dbbroadcast-mozart-dds-next-7000-firmware | — | — | — |