Command Injection Vulnerability in Kenwood DMX958XR Devices
CVE-2025-8654

8.8HIGH

Key Information:

Vendor

Kenwood

Status
Dmx958xr
Vendor
CVE Published:
6 August 2025

What is CVE-2025-8654?

A command injection vulnerability exists in Kenwood DMX958XR devices due to inadequate validation of user-supplied input in the ReadMVGImage function. This flaw allows remote attackers, with no authentication needed, to execute arbitrary code at the root level. Exploiting this vulnerability could lead to severe risks for device integrity and user data.

Affected Version(s)

DMX958XR 1.0.0509.3100

References

https://www.zerodayinitiative.com/advisories/ZDI-25-802/
x_research-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-8654 : Command Injection Vulnerability in Kenwood DMX958XR Devices