VulnerabilityAnalyzed
CVE-2025-66723
inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.
HIGH 7.5EPSS 0.42%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.42% probability · 35th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Affected
- inmusicbrands/engine dj desktop
- Source
- cve@mitre.org
References
- https://github.com/audiopump/cve-2025-66723Exploit, Third Party Advisory
- https://www.inmusicbrands.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.