Command Injection Vulnerability in Kenwood DMX958XR Firmware

CVE-2025-8647

What is CVE-2025-8647?

A command injection vulnerability exists in the firmware update process of Kenwood DMX958XR devices. This flaw arises due to inadequate validation of user-supplied strings before executing system calls. As a result, an attacker with physical access can exploit this weakness to run arbitrary code with root privileges, granting them extensive control over the device's functionality. No authentication is necessary to leverage this vulnerability, making it particularly concerning for device security.

References