PatchTheCVEphoniebox vulnerabilities and fixes
Recent CVEs affecting phoniebox, with upgrade or downgrade steps. 8 tracked.
phoniebox has 8 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-12-18. Highest priority: CVE-2024-41369 (score 60/100).
- CVE-2025-63951 HIGH 7.5 UPGRADE An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID pr
- CVE-2024-41369 CRITICAL 9.8 DOWNGRADE RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.s
- CVE-2024-41368 CRITICAL 9.8 DOWNGRADE RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.s
- CVE-2024-41367 CRITICAL 9.8 DOWNGRADE RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\p
- CVE-2024-41366 CRITICAL 9.8 DOWNGRADE RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userS
- CVE-2024-41364 CRITICAL 9.8 DOWNGRADE RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\track
- CVE-2024-41361 CRITICAL 9.8 DOWNGRADE RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manag
- CVE-2024-0714 MEDIUM 6.3 UPGRADE A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.5.0
FAQ
How do I fix phoniebox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is phoniebox being exploited right now?
None of the tracked phoniebox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which phoniebox CVE should I patch first?
CVE-2024-41369 currently ranks highest (60/100): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.s.