Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, specifically within the firmware update process. This issue allows physically present attackers to execute arbitrary code with root privileges on the affected device. The vulnerability arises from inadequate validation of user-supplied strings before they are used to execute system calls, creating an opportunity for code execution. Notably, no authentication is required to exploit this flaw.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

Due to the nature of this vulnerability, the primary recommended mitigation strategy is to limit physical access to the device.