There is a substantive security vulnerability within RPi-Jukebox-RFID (version 2.8.0). RPi-Jukebox-RFID is an open-source media jukebox system designed for Raspberry Pi. Due to this defect, an attacker can exploit an unsecured API endpoint to achieve unauthenticated, remote code execution on the targeted machine.
Specifically, the issue in question is logged under CVE-2025-10327. The source of the weakness can be traced back to the way in which the application processes input data when shuffling a playlist.
This vulnerability applies to all instances of RPi-Jukebox-RFID (Phoniebox) running version 2.8.0. The API endpoint that is affected is shuffle.php.
This security vulnerability is limited to devices running Raspberry Pi OS, and it can be exploited remotely over the internet. In addition, no authentication necessary in order to exploit the vulnerability.
Technical Description
This vulnerability results from an OS command injection vulnerability in the shuffle.php API endpoint, which allows attackers to use user-supplied values to execute OS commands.
The application is vulnerable because there is no validation of the input passed by a user when the API enters the filename of the playlist, allowing the user to execute arbitrary shell commands on the server by sending formatted JSON requests.
As the endpoint was intended for API access, users do not need to interact with the server in order for their attack to succeed; once the server is up and running and is publicly accessible, users can launch a successful attack using this vulnerability without physically logging into the server first.
Why Is This Important?
RPi-Jukebox-RFID is commonly found in:
1. Personal media systems
2. Educational settings
3. Public and private installations
4. DIY/maker projects
5. Small embedded systems/kiosks
Usually, these devices run 24/7, are rarely patched, and can often be accessed either locally or from outside networks. If an attacker can achieve a successful compromise, it could lead to:
1. Complete device compromise
2. Backdoor installation
3. Data theft
4. Lateral movement through the internal network
5. Using the device as a botnet or proxy
Real-World Risks
Raspberry Pi devices are often viewed as low-risk (or "non-critical") devices, making them prime targets for attackers. An unauthenticated remote code execution vulnerability in a popular open-source project increases the susceptibility of these devices to opportunistic exploitation, particularly in shared, poorly segmented networks.
Recommended Mitigations
Administrators and end-users should consider implementing the following risk mitigation strategies:
1. If possible, perform an upgrade to a patched version.
2. To the extent possible, restrict access to the /phoniebox/api/ endpoints.
3. To the extent possible, disable all externally available web interface access.
4. Use a firewall or VPN to help protect your device.
5. Ensure that the web service is not run with increased privileges.
6. Periodically audit and monitor any Raspberry Pi services that are accessible from the Local Area Network.
As a best practice, if API functionality is not necessary, disable it altogether.
Key Takeaway
CVE-2025-10327 highlights that embedded systems and hobbyist systems have vulnerabilities that put them at risk just like enterprise systems have exploitable vulnerabilities. Even the most basic API can serve as a significant threat vector when user-supplied input is treated as safe by default.
Proper input validation and network segregation are paramount no matter how large the system or its intended use.
Source: Exploit DB
