Remote Code Execution Vulnerability in Kenwood DMX958XR Devices

CVE-2025-8651

What is CVE-2025-8651?

A command injection vulnerability has been identified in the JKWifiService of Kenwood DMX958XR devices. This flaw permits an attacker with physical access to execute arbitrary code without authentication. The vulnerability arises due to inadequate validation of a user-supplied string before it's utilized in a system call, allowing unauthorized command execution in the context of the root user. It is crucial for users of affected devices to implement mitigation strategies to prevent potential exploitation.

References