CVE-2025-10328
Published: 12 September 2025
Summary
CVE-2025-10328 is a low-severity Command Injection (CWE-77) vulnerability in Sourcefabric Rpi-Jukebox-Rfid. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).
Deeper analysis
A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to version 2.8.0. The issue affects an unknown function in the file /htdocs/api/playlist/playsinglefile.php, where manipulation of the File argument enables OS command injection. The flaw is tracked under CWE-77 and CWE-78, carries a CVSS 4.0 score of 2.1, and can be triggered remotely.
An authenticated remote attacker with low privileges can supply a crafted File parameter to execute operating system commands on the target system, resulting in limited impacts to confidentiality, integrity, and availability. The exploit has been made public and does not require user interaction.
No vendor patch or mitigation guidance is available. The vendor was notified prior to disclosure but did not respond.
The exploit proof-of-concept is hosted on GitHub, yet the associated EPSS score remains flat at 0.0128 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29085
Vulnerability details
A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated…
more
remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection vulnerability in public-facing web endpoint (/htdocs/api/playlist/playsinglefile.php) enables exploitation of public-facing application (T1190), indirect command execution via the vulnerable script (T1202), and remote execution of Unix shell commands (T1059.004) on Linux-based Raspberry Pi system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the File argument in playsinglefile.php to block malicious OS command payloads before execution.
Enforces boundary protections that can restrict or deny remote network access to the vulnerable /api/playlist/playsinglefile.php endpoint.
Limits system functionality by disabling or removing the exposed playsinglefile.php endpoint when the feature is not required.