CVE-2025-66723

inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all…

High · published December 30, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

⚡ An exposed HTTP service in Engine DJ is like leaving the backdoor open at a party—anyone can waltz in and explore your files! Think of it as a library where anyone can walk in without checking in at the front desk, rummaging through every book and resource without permission. Without proper permissions, it's just too easy to access sensitive information! This vulnerability allows attackers to access every file and network path on your system, opening the door for data theft or worse. Imagine someone rifling through your private playlists and files; it could lead to absolute chaos and compromise your entire setup!

Put simply

Think of it as a library where anyone can walk in without checking in at the front desk, rummaging through every book and resource without permission. Without proper permissions, it's just too easy to access sensitive information! The insecure permissions in Engine DJ prior to version 4.3.4 expose an HTTP service that grants unauthorized file access to malicious actors, enabling them to reach sensitive data without any barriers.

What to do

This vulnerability allows attackers to access every file and network path on your system, opening the door for data theft or worse. Imagine someone rifling through your private playlists and files; it could lead to absolute chaos and compromise your entire setup! To secure your system, upgrade to Engine DJ version 4.3.4 or later immediately. Also, review your service permissions to ensure that only authorized users can access critical files and paths. Regular audits are a great way to keep your setup secure! You’ve got the power to lock this down! Stay vigilant, follow these steps, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.1th percentile
Published
2025-12-30T00:00Z
EPSS history
Timeline
  • 30 DEC 00:00Z
    inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all…
    cvelistv5