Lyrion Music Server (formerly Logitech Media Server, and often abbreviated as "LMS" ) is open-source software which can control and serve (stream) music to a wide range of physical and virtual audio players called Squeezeboxes. Lyrion Music Server can stream your local music collection, internet radio stations, and content from many streaming services (with and without subscriptions). The Command Line Interface plugin allows Squeezebox software and the players to be controlled remotely over a TCP/IP connection, for example by a third party automation system like AMX or Crestron.
Lyrion Music Server exposes a readdirectory query through both its CLI service (TCP port 9090) and its HTTP JSON-RPC endpoint (/jsonrpc.js) that takes a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration. A remote attacker on the network can enumerate arbitrary locations on the host filesystem.