Command Injection Vulnerability in Kenwood DMX958XR Products
CVE-2025-8652

6.8MEDIUM

Key Information:

Vendor

Kenwood

Status
Dmx958xr
Vendor
CVE Published:
6 August 2025

What is CVE-2025-8652?

The command injection vulnerability in Kenwood DMX958XR devices affects the JKWifiService component, permitting unauthorized remote code execution. Attackers who have physical access can exploit this flaw by supplying malicious user input, which is improperly validated before being used in system calls. This deficiency allows the execution of arbitrary code with root privileges, posing significant risks to the integrity and security of the device.

Affected Version(s)

DMX958XR 1.0.0509.3100

References

https://www.zerodayinitiative.com/advisories/ZDI-25-800/
x_research-advisory

CVSS V3.0

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-8652 : Command Injection Vulnerability in Kenwood DMX958XR Products