Firmware Update Command Injection Vulnerability in Kenwood DMX958XR Devices

CVE-2025-8636

What is CVE-2025-8636?

The Kenwood DMX958XR contains a vulnerability in its firmware update process that allows an attacker with physical access to the device to execute arbitrary code. Due to insufficient validation of a string provided by the user, malicious actors can manipulate the system call execution, enabling them to potentially gain root access. This lack of authentication empowers attackers to exploit the flaw without any pre-conditions, making affected installations critically vulnerable, especially in environments where physical security cannot be guaranteed.

References