PatchTheCVECVE-2025-66251: Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A
CVE-2025-66251 is a critical-severity flaw (CVSS 9.1) affecting mozart next 100 firmware, mozart next 1000 firmware, mozart next 2000 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows path traversal deletion of arbitrary .tgz files.
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 56%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2025-11-26 |
| Last modified | 2026-10-18 |
Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-66251?
mozart next 100 firmware: mitigate or apply the listed mitigation; mozart next 1000 firmware: mitigate or apply the listed mitigation; mozart next 2000 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-66251 being exploited?
CVE-2025-66251 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-66251 affect?
CVE-2025-66251 affects mozart next 100 firmware, mozart next 1000 firmware, mozart next 2000 firmware. Severity is critical (CVSS 9.1). Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden p
How urgent is CVE-2025-66251?
Priority 53/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-66253 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A
- CVE-2025-66261 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A
- CVE-2025-66262 CRITICAL 9.8 MITIGATE MITIGATE Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A
- CVE-2025-66259 CRITICAL 9.8 MITIGATE MITIGATE Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni
- CVE-2025-66250 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A