DB Electronica Mozart FM Transmitter Reflected XSS Vulnerability (CVE-2025-63229)

Key Information Summary Vulnerability Overview CVE ID: CVE-2025-63229 Vulnerability Name: DB Electronica Mozart FM Transmitter XSS Vulnerability Description This vulnerability exists in the Web management interface of the Mozart FM Transmitter at the endpoint and is a reflected Cross-Site Scripting (XSS) flaw. By injecting malicious JavaScript into the parameter, an attacker may execute arbitrary code in the victim's browser, leading to sensitive information theft, session hijacking, or unauthorized operations. Vulnerability Details Vendor: DB Electronica Telecomunicazioni S.p.A. Vendor Homepage: https://www.dbbroadcast.com/ Affected Products: - Product: Mozart FM Transmitter - Versions: 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 Vulnerable Endpoint: Attack Type: Reflected Cross-Site Scripting (XSS) Impact Severity: High Attack Vector: - Access Method: Remote via Web interface - Authentication Required: None (depending on device configuration) - Exploit Complexity: Low Vulnerability Type Information Vulnerability Type: Cross-Site Scripting (XSS) CWE-ID: CWE-79 Definition: Placing user-controllable input into output that is rendered as a web page to other users without proper neutralization or sanitization. Potential Impact Information Disclosure: Theft of Cookies, tokens, or other sensitive data Session Hijacking: Unauthorized use of user sessions Content or Malware Injection: Potential injection of harmful content into the Web interface Proof of Concept (PoC) Request Example: Mitigation Recommendations Input Validation: Sanitize and validate user input to prevent script injection. Output Encoding: Encode dynamic content before inserting it into HTML responses. Content Security Policy (CSP): Implement a strong CSP to block unauthorized script execution. Access Control: Ensure sensitive endpoints are authenticated and protected. Testing: Conduct regular vulnerability assessments for XSS and related issues.

Goal Reached Thanks to every supporter — we hit 100%!

DB Electronica Mozart FM Transmitter Reflected XSS Vulnerability (CVE-2025-63229)

More from this source