PT-2025-31548 · Russound · Russound Mbx-Pre-D67F

Yazeed Alewah · Published 2025-07-31 · Updated 2025-08-03 · CVE-2025-50475

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Russound MBX-PRE-D67F version 3.1.6

Description An OS command injection issue exists in the network configuration handler, allowing unauthenticated attackers to execute arbitrary commands as root. The vulnerability is due to improper neutralization of special elements used in an OS command. This enables remote code execution with the highest privileges via crafted input to the hostname parameter in network configuration requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-50475

Affected Products

Russound Mbx-Pre-D67F

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-50475 · Security Note
• https://pastebin.com/ic8hkC5V · Note
• https://t.me/CVEtracker/28863 · Telegram Post
• https://drive.google.com/file/d/1ZmZHzJKU-nrhFXd9w94aiGXYYYldtmni/view?usp=sharing · Note
• https://twitter.com/CVEnew/status/1950939122383888797 · Twitter Post
• https://pastebin.com/raw/0U6F55G5 · Note
• https://twitter.com/SecAideInfo/status/1951950036784517126 · Twitter Post