CVE-2025-66261

CVE-2025-66261 describes an unauthenticated OS command injection vulnerability in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitters across various versions. Attackers can exploit the restore_settings.php endpoint by injecting arbitrary shell commands into the URL-decoded 'name' parameter, leading to remote code execution as the web server user. This critical vulnerability, with a CVSS score of 9.8, allows for complete compromise of confidentiality, integrity, and availability without requiring authentication or user interaction. While there is no known active exploitation, publicly available exploit code, or KEV listing, the vulnerability has garnered some community discussion.