CVE-2025-10328 in RPi-Jukebox-RFID
Summary
by MITRE • 09/13/2025
A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2025
This vulnerability exists within the MiczFlor RPi-Jukebox-RFID software version 2.8.0 and earlier, specifically targeting the playlist management functionality through the playsinglefile.php API endpoint. The flaw represents a critical operating system command injection vulnerability that allows remote attackers to execute arbitrary commands on the affected system by manipulating the File argument parameter. The vulnerability stems from insufficient input validation and sanitization within the application's handling of user-supplied data, creating a direct pathway for malicious command execution. This type of vulnerability falls under CWE-77 which specifically addresses improper neutralization of special elements used in OS commands, making it particularly dangerous in networked environments where unauthorized access can lead to complete system compromise.
The technical exploitation of this vulnerability occurs through the manipulation of the File argument within the API endpoint, which directly influences how the system processes file operations. When an attacker submits malicious input through this parameter, the application fails to properly validate or sanitize the input before using it in system commands, allowing attackers to inject OS commands that execute with the privileges of the web application. This remote attack vector eliminates the need for physical access or local system credentials, making the vulnerability particularly concerning for publicly accessible installations. The disclosure of this exploit publicly means that threat actors can immediately leverage this vulnerability without requiring advanced technical knowledge or extensive reconnaissance, as the attack methodology has already been made available in the public domain.
The operational impact of this vulnerability extends far beyond simple unauthorized command execution, as it provides attackers with complete control over the affected Raspberry Pi system running the jukebox software. Attackers can potentially gain access to audio files, modify system configurations, install malicious software, or even use the compromised device as a pivot point for attacking other systems within the local network. The vulnerability affects not only the media playback functionality but also exposes the underlying operating system, potentially compromising the entire multimedia server infrastructure. Given that this is a Raspberry Pi-based system, the attack surface is further expanded as attackers can leverage the compromised device to conduct broader network reconnaissance or establish persistent access points. The lack of vendor response after early notification creates a significant risk for organizations that have deployed this software, as no official patches or mitigation guidance are available to address the vulnerability.
Organizations utilizing this software should immediately implement network-level mitigations to restrict access to the affected API endpoints, particularly blocking external access to the playsinglefile.php functionality. The most effective immediate remediation involves implementing strict input validation and sanitization measures at the application level, ensuring that all user-supplied parameters are properly validated before any system operations are performed. Network segmentation and firewall rules should be configured to limit access to the affected API endpoints to trusted sources only, while monitoring should be implemented to detect unusual patterns of API usage that might indicate exploitation attempts. Additionally, system administrators should conduct comprehensive security audits to identify any potential compromise indicators, including unauthorized access logs, unusual network traffic patterns, or unexpected changes to system configurations. The vulnerability also highlights the importance of maintaining up-to-date software versions and establishing effective vulnerability disclosure and response procedures with software vendors to prevent similar situations in the future.