A critical insecure deserialization vulnerability in the RPi-Jukebox-RFID project allows unauthenticated attackers to trigger a denial of service condition.

The rss-mp3.php script fails to validate data passed to the unserialize function via the rss GET parameter, allowing an unauthenticated remote attacker to inject arbitrary objects.

The vulnerability carries a CVSS score of 7.5, reflecting its high impact on service availability. Successful exploitation allows an attacker to cause an application crash or denial of service, which can disrupt critical operations for users relying on the jukebox system. Because the attack requires no authentication, the barrier to entry is extremely low for external actors.

Immediate Action: Review the project repository for the latest commit and apply the corresponding security update. If a patch is not yet available, restrict access to the rss-mp3.php script at the network or web server level.

Proactive Monitoring: Monitor server logs for unusual GET requests containing serialized PHP objects or repeated attempts to access the rss-mp3.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize input containing serialized data patterns directed at the rss-mp3.php endpoint.

Public Exploit Available: Yes, a published PoC exists, attributed to the research write-up provided in the vulnerability references.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to RPi-Jukebox-RFID deployments. Administrators must prioritize updating the software to a version beyond the affected commit or implement strict network access controls to the vulnerable script to prevent unauthorized exploitation.