CVE-2025-10327
Published: 12 September 2025
Summary
CVE-2025-10327 is a low-severity Command Injection (CWE-77) vulnerability in Sourcefabric Rpi-Jukebox-Rfid. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
A weakness identified as CVE-2025-10327 affects MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The issue resides in an unknown function within the file /htdocs/api/playlist/shuffle.php, where improper handling of the playlist argument enables OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 2.1 reflecting network attack vector, low attack complexity, and limited impact on confidentiality, integrity, and availability.
Remote attackers with low privileges can supply a crafted playlist value to execute arbitrary operating system commands on the affected device. Public exploit code has been released, including detailed proof-of-concept material on GitHub and Exploit-DB, confirming that the attack requires no user interaction and can be launched over the network.
The vendor was notified prior to disclosure but provided no response, and the listed references contain no mitigation guidance or patch information. The associated EPSS score has remained flat at 0.0386 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29077
Vulnerability details
A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched…
more
remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability in the public-facing web API (/htdocs/api/playlist/shuffle.php) enables exploitation of public-facing application (T1190), indirect command execution (T1202), and execution via Unix Shell (T1059.004) on the Linux-based Raspberry Pi system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the playlist argument before it reaches the OS command interpreter in shuffle.php, blocking the CWE-78 injection vector.
Limits the privileges of the web-server process so that even a successful command injection yields only minimal OS access and impact.
Enforces least functionality by disabling or removing unnecessary OS shells/utilities that the injected commands would otherwise invoke.