CVE-2025-50475: Critical OS Command Injection Vulnerability in Russound MBX-PRE-D67F Firmware

Overview

The cybersecurity landscape is constantly evolving with new vulnerabilities being discovered on a regular basis. One such recent discovery is the CVE-2025-50475 vulnerability. This vulnerability affects Russound MBX-PRE-D67F firmware version 3.1.6 and has the potential to lead to system compromise or data leakage. The severity of this vulnerability, as well as its wide reach, makes it a matter of utmost concern for organizations relying on this firmware.
The CVE-2025-50475 vulnerability stems from the improper neutralization of special elements used in an OS command within the network configuration handler. This allows for remote code execution with the highest privileges, making it a critical security issue that requires immediate attention and mitigation.

Vulnerability Summary

CVE ID: CVE-2025-50475
Severity: Critical, CVSS score 9.8
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Russound MBX-PRE-D67F Firmware | 3.1.6

How the Exploit Works

The vulnerability resides in the handling of network configuration requests within the Russound MBX-PRE-D67F firmware. Specifically, the hostname parameter of these requests is not properly sanitized before being used to construct an operating system command.
This allows an unauthenticated attacker to inject arbitrary commands that will be executed as root upon the host system. Due to the lack of proper input sanitization, an attacker can craft a malicious payload that includes OS command syntax, which the firmware will execute without verification. This effectively enables the attacker to execute arbitrary commands with the highest privileges, leading to potential system compromise or data leakage.

Conceptual Example Code

Here is a
conceptual
example of a malicious HTTP request that exploits the vulnerability:

POST /network/config HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "hostname": "; rm -rf /;" }

In this example, the malicious payload `”; rm -rf /;”` is inserted into the hostname parameter. The semicolons serve as command separators, allowing the attacker to append the `rm -rf /` command, which, if executed, would delete all files on the server.
It’s important to note that this is a simplified representation of an exploit. In a real-world scenario, the attacker would likely use a more complex and less detectable command. The specific contents of the malicious payload would largely depend on the attacker’s objective and the specific characteristics of the target system.