Command Injection in Kenwood DMX958XR Enables Remote Code Execution

CVE-2025-8649

What is CVE-2025-8649?

A command injection vulnerability exists within the JKWifiService of Kenwood DMX958XR devices, allowing physically present attackers to execute arbitrary code. The flaw stems from inadequate validation of user-supplied input, which can be exploited without the need for authentication. Successful exploitation enables attackers to run commands with root privileges, posing significant security risks for affected installations.

References