CVE-2024-0714 is a medium severity flaw in MiczFlor RPi-Jukebox-RFID (Phoniebox) up to 2.5.0, scored 6.3 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists MiczFlor RPi-Jukebox-RFID (Phoniebox) up to 2.5.0 as affected. The record says the folder argument handled in userScripts.php, part of the HTTP request handler, leads to OS command injection and that the attack may be launched remotely. It notes the vendor was contacted early and did not respond. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness is CWE-78.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
On each device, check the installed version of the project, for example by reading the version noted in the web interface or the repository tag you installed from. Anything up to 2.5.0 is in scope. Check whether the web interface is reachable from outside your local network, including through router port forwarding.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
OS command injection occurs when text from a request is passed to a shell, so special characters can turn data into commands. The record does not give a fixed release. It describes the affected file and argument, and I am not reproducing the example input that appears in the record.
Phoniebox is a hobby music player project for Raspberry Pi devices, and many installs run on home networks with the web interface open to every device on the LAN. The score is medium because the record's vector requires a low privilege account and rates impact low. On a small device that also holds Wi-Fi credentials and can reach other home devices, command execution is still worth preventing.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Quick check
Does the vendor provide a patch?
None is confirmed. The record says the vendor did not respond.
Is the web interface the only way in?
The record names the HTTP request handler, so restricting who can reach the web interface is the first control.
Sources
Last reviewed: 19 October 2026.
