CVE-2025-66252: Mozart FM Transmitter DoS Vulnerability

CVE-2025-66252 Overview

CVE-2025-66252 is an infinite loop denial-of-service vulnerability affecting DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter firmware. The flaw resides in the status_contents.php script, which performs file deletion inside a while loop without bounded retry logic. When unlink() fails because the target file is immutable or the web process lacks delete permissions, the loop retries the operation indefinitely. This consumes process resources and renders the transmitter management interface unresponsive. The vulnerability is categorized under CWE-835 (Loop with Unreachable Exit Condition).

Critical Impact

An authenticated attacker with high privileges can trigger an infinite loop that exhausts process resources and disrupts the broadcast management interface of FM transmitters used in radio broadcasting infrastructure.

Affected Products

• DB Electronica Mozart Next FM Transmitters (models 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000)
• DB Electronica Mozart DDS Next FM Transmitters (models 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000)
• Associated firmware for all Mozart Next and Mozart DDS Next variants

Discovery Timeline

• 2025-11-26 - CVE-2025-66252 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-66252

Vulnerability Analysis

The vulnerability exists in the status_contents.php component of the Mozart transmitter web management interface. The script invokes the PHP unlink() function inside a while loop intended to delete one or more files. The loop's exit condition depends on the success of unlink(), but the code does not handle the case where deletion fails for non-transient reasons.

When a target file has the immutable attribute set (chattr +i) or sits in a directory where the web server process lacks write permissions, unlink() returns false on every iteration. The loop never advances past the failing file, and the PHP request handler enters a non-terminating cycle. The process consumes CPU time until the PHP execution limit is reached or the worker is killed by a watchdog.

Repeated requests against the vulnerable endpoint can saturate available PHP-FPM or CGI workers, making the management interface inaccessible to legitimate operators.

Root Cause

The root cause is a missing loop termination condition for failure states. The developer assumed that unlink() would either succeed immediately or that the file would eventually become deletable. No iteration counter, timeout, or error-state break statement was implemented. This is a textbook example of CWE-835, where a control-flow predicate cannot be reached under specific runtime conditions.

Attack Vector

The attack requires network access to the transmitter's web interface and authenticated access with high privileges. An attacker who can specify or influence the file path passed to status_contents.php directs the script toward an undeletable file. Triggering the endpoint multiple times exhausts the web server's worker pool. Because FM transmitters are often remotely managed across broadcast networks, the network-reachable attack surface is meaningful for radio operators.

No verified proof-of-concept code is publicly available. Technical details are documented in the Abdul MHS Blog Analysis.

Detection Methods for CVE-2025-66252

Indicators of Compromise

• Repeated HTTP requests to status_contents.php from a single source within a short time window
• PHP worker processes pinned at high CPU utilization for extended periods
• Web server logs showing requests to the file-deletion endpoint followed by request timeouts or 502/504 errors
• Operator reports of unresponsive Mozart transmitter management UIs

Detection Strategies

• Monitor PHP process CPU and execution time on the transmitter's embedded web server for anomalous long-running requests
• Inspect web server access logs for high-frequency POST or GET requests targeting status_contents.php
• Alert on filesystem syscall patterns showing repeated unlink() failures against the same inode
• Correlate authentication events for privileged accounts with subsequent management-interface unresponsiveness

Monitoring Recommendations

• Deploy network-layer logging in front of transmitter management interfaces to capture full request URIs and source IPs
• Track PHP-FPM worker pool saturation metrics and configure alerts for worker exhaustion
• Centralize broadcast equipment logs in a SIEM to correlate management-plane anomalies with operator activity
• Review privileged account usage on transmitter web interfaces and flag deviations from normal change windows

How to Mitigate CVE-2025-66252

Immediate Actions Required

• Restrict network access to the transmitter management interface to trusted operator networks only, using firewall ACLs or VPN-gated access
• Audit and reduce the number of accounts holding high-privilege roles on the Mozart web interface
• Monitor status_contents.php requests and rate-limit access at a reverse proxy or WAF layer
• Contact DB Electronica Telecomunicazioni S.p.A. for firmware updates or vendor guidance specific to your transmitter model

Patch Information

No vendor advisory or firmware patch URLs are listed in the NVD record at the time of publication. Operators should engage DB Electronica Telecomunicazioni S.p.A. directly to obtain remediation guidance and any firmware revisions addressing CVE-2025-66252. Until a patch is available, compensating network controls are the primary defense.

Workarounds

• Place the transmitter management interface behind a reverse proxy that enforces request rate limits on the status_contents.php endpoint
• Segment broadcast equipment onto an isolated management VLAN with no direct internet exposure
• Enforce strong authentication and rotate credentials for any account with delete privileges in the Mozart web interface
• Configure web server execution timeouts (for example, PHP max_execution_time) to terminate runaway requests faster and free worker slots

# Example reverse proxy rate limit (nginx) for the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=mozart_status:10m rate=5r/m;

location = /status_contents.php {
    limit_req zone=mozart_status burst=2 nodelay;
    allow 10.0.0.0/24;   # operator management subnet
    deny all;
    proxy_pass http://mozart_backend;
}