CVE-2025-66263

CVE-2025-66263 describes an unauthenticated arbitrary file read vulnerability affecting DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitters (various models). An attacker can exploit a null byte injection flaw in the download_setting.php endpoint to bypass file extension restrictions and read arbitrary files from the system. This vulnerability has a CVSS score of 7.5 (High), indicating a critical risk due to its network-based attack vector, low attack complexity, and high confidentiality impact without requiring user interaction or privileges. While no active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB) has been identified, and community discussion is minimal, the FAUCET Risk Score of 85/100 suggests a significant potential for exploitation.