CVE-2025-8639: (0Day) Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26262.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate physically present exploitation by restricting physical access to affected Kenwood DMX958XR devices (e.g., secure installation location and restrict who can trigger the firmware update process).
- Compensating control
Since the flaw is in the firmware update process (command injection via insufficient validation of a user-supplied string), prevent untrusted/unauthorized triggering of firmware updates on affected Kenwood DMX958XR devices (e.g., limit ability to initiate updates to authorized users only).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8639?
CVE-2025-8639 is considered a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2025-8639?
To fix CVE-2025-8639, users should apply the latest firmware updates provided by Kenwood for the DMX958XR device.
Who is affected by CVE-2025-8639?
CVE-2025-8639 affects users of the Kenwood DMX958XR who have not updated their firmware to a secure version.
Can CVE-2025-8639 be exploited remotely?
No, CVE-2025-8639 requires physical access to the Kenwood DMX958XR device for exploitation.
What type of vulnerability is CVE-2025-8639?
CVE-2025-8639 is a command injection vulnerability that allows for arbitrary code execution.