CVE-2025-10327
Published: 12 September 2025
Summary
CVE-2025-10327 is a medium-severity Command Injection (CWE-77) vulnerability in Sourcefabric Rpi-Jukebox-Rfid. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability in the public-facing web API (/htdocs/api/playlist/shuffle.php) enables exploitation of public-facing application (T1190), indirect command execution (T1202), and execution via Unix Shell (T1059.004) on the Linux-based Raspberry Pi system.
NVD Description
A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched…
more
remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-10327 is an OS command injection vulnerability (CWE-77, CWE-78) in MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The issue affects an unknown functionality in the file /htdocs/api/playlist/shuffle.php, where manipulation of the "playlist" argument enables command injection. It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-09-12.
The vulnerability is exploitable remotely by low-privileged users over the network with low attack complexity and no user interaction required. Successful exploitation allows attackers to execute arbitrary operating system commands on the affected system.
Advisories from VulDB and related references indicate that the vendor was contacted early about the disclosure but provided no response or patch. Public exploits are available, including detailed proof-of-concept on GitHub (YZS17/CVE) and Exploit-DB (exploit 52468).
Details
- CWE(s)