RPi-Jukebox-RFID 2.8.0 suffers from a remote command execution (RCE) vulnerability identified as CVE-2025-10327. The vulnerability exists in the shuffle.php API endpoint, where the 'playlist' parameter is used unsafely in a shell command without proper input sanitization or escaping. This allows an attacker to inject arbitrary OS commands by crafting a malicious JSON payload and sending it via an HTTP PUT request. The provided proof-of-concept exploit, written in Python, demonstrates this by injecting a command that creates a file on the target system, confirming code execution. The vulnerability affects Raspberry Pi devices running the RPi-Jukebox-RFID software, commonly used for audio jukebox functionality with RFID integration. Since the exploit requires no authentication and can be triggered remotely, it poses a significant risk to affected devices exposed to untrusted networks. The flaw compromises system confidentiality, integrity, and availability, as attackers can execute any command with the privileges of the running service. No official patch links are currently provided, and no known active exploitation in the wild has been reported yet. However, the presence of public exploit code increases the likelihood of exploitation attempts. The vulnerability highlights the risks of improper input handling in web APIs, especially in IoT and embedded device software. Organizations using this software should monitor for updates from the vendor and consider network-level protections to mitigate exposure.

For European organizations, this vulnerability could lead to unauthorized remote control of Raspberry Pi devices running RPi-Jukebox-RFID, potentially resulting in data breaches, service disruption, or pivoting to other internal systems. Although primarily targeting niche IoT or hobbyist devices, compromised devices could be leveraged as entry points into corporate or educational networks. The impact includes loss of confidentiality due to arbitrary command execution, integrity violations through unauthorized modifications, and availability issues if attackers disrupt device functionality. Given the popularity of Raspberry Pi in European educational institutions, maker spaces, and small businesses, the threat could affect a wide range of environments. Additionally, if these devices are connected to larger networks without proper segmentation, attackers could escalate attacks. The medium severity rating reflects the balance between ease of exploitation and the limited scope of affected devices, but the risk is non-negligible for organizations relying on this software or similar IoT setups.

1. Apply patches or updates from the RPi-Jukebox-RFID vendor as soon as they become available to fix the command injection vulnerability. 2. If patches are not yet available, restrict network access to the affected devices by implementing firewall rules that limit inbound connections to trusted IPs only. 3. Disable or restrict the vulnerable API endpoint (shuffle.php) if it is not essential for operations. 4. Employ web application firewalls (WAFs) or intrusion detection/prevention systems (IDS/IPS) to detect and block malicious payloads targeting the API. 5. Conduct input validation and sanitization on all user-supplied data before passing it to system commands, ideally by the vendor in future releases. 6. Segment IoT and Raspberry Pi devices on separate network zones to reduce lateral movement risk. 7. Monitor device logs and network traffic for unusual activity indicative of exploitation attempts. 8. Educate users and administrators about the risks of exposing IoT devices to untrusted networks and the importance of timely updates.