PatchTheCVECVE-2025-66254: Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A
CVE-2025-66254 is a critical-severity flaw (CVSS 9.1) affecting mozart next 100 firmware, mozart next 1000 firmware, mozart next 2000 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary files. The `deleteupgrade` parameter in `/var/www/upgrade_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/upload/` witho
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 65%) |
| CISA exploited list | No |
| Weakness | CWE-73 |
| Published | 2025-11-26 |
| Last modified | 2026-10-18 |
Last updated 2026-10-18 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-66254?
mozart next 100 firmware: mitigate or apply the listed mitigation; mozart next 1000 firmware: mitigate or apply the listed mitigation; mozart next 2000 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-66254 being exploited?
CVE-2025-66254 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-66254 affect?
CVE-2025-66254 affects mozart next 100 firmware, mozart next 1000 firmware, mozart next 2000 firmware. Severity is critical (CVSS 9.1). Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgra
How urgent is CVE-2025-66254?
Priority 51/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-66253 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A
- CVE-2025-66261 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A
- CVE-2025-66262 CRITICAL 9.8 MITIGATE MITIGATE Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A
- CVE-2025-66259 CRITICAL 9.8 MITIGATE MITIGATE Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni
- CVE-2025-66250 CRITICAL 9.8 MITIGATE MITIGATE Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A