All other solutions seem to assume that the digit group is alone in a string with the exception of JavaFan's, which, with the addition of the /g modifier, will handle several digit groups embedded in a string.

Here's another solution for handling strings with multiple digit groups. This needs 5.10+ and uses '_' instead of 'X' as the masking character for clarity of result comparison.

>perl -wMstrict -le
"my $start = 6;
 my $end   = 4;
 ;;
 my $s = '1 123456321 1234564321 '
       . '12345654321 123456654321 1234567654321 12345687654321'
       ;
 print qq{'$s'};
 ;;
 $s =~ s{ (?<! \d) \d{$start} \K  \d+  (?= \d{$end} (?! \d)) }
        { '_' x length ${^MATCH}                             }xmsgpe;
 print qq{'$s'};
"
'1 123456321 1234564321 12345654321 123456654321 1234567654321 1234568
+7654321'
'1 123456321 1234564321 123456_4321 123456__4321 123456___4321 123456_
+___4321'
[download]