CVE-2025-8656: (0Day) (Pwn2Own) Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability
Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the libSystemLib library. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26355.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
ZDI-CAN-26355: Mitigate physically present attackers by restricting physical access to Kenwood DMX958XR devices (and any update interface) to trusted personnel/locations.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8656?
CVE-2025-8656 is considered to be a medium severity vulnerability due to its potential for unauthorized software downgrades.
How do I fix CVE-2025-8656?
To fix CVE-2025-8656, ensure that your Kenwood DMX958XR device is updated with the latest firmware that addresses this vulnerability.
Who is affected by CVE-2025-8656?
Users of the Kenwood DMX958XR devices are affected by CVE-2025-8656 due to the potential for physical attacks on the device.
Can CVE-2025-8656 be exploited remotely?
No, CVE-2025-8656 requires physical access to the Kenwood DMX958XR device to exploit the software downgrade vulnerability.
What kind of impact does CVE-2025-8656 have?
The impact of CVE-2025-8656 allows an attacker to downgrade the device's software, which could expose it to other vulnerabilities.