Pioneer DMH-WT7600NEX Telematics Directory Traversal Arbitrary File Creation Vulnerability

A vulnerability exists in the Pioneer DMH-WT7600NEX device within the telematics functionality, allowing network-adjacent attackers to create arbitrary files. This issue arises from inadequate validation of user-supplied paths before they are used in file operations. Although authentication is required to exploit this vulnerability, the authentication mechanism can be bypassed. Attackers could potentially combine this vulnerability with others to execute arbitrary code with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized file creation, with the potential for executing arbitrary code as the root user.

Remediation

Pioneer has released a patch for this vulnerability. Instructions for downloading the update can be found on the Pioneer Japan website.