Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code on the device. This issue arises from inadequate validation of user-supplied strings during the firmware update process, enabling code execution with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code on the affected device, with root-level privileges.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit physical access to the device.