Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code with root privileges. This issue arises from inadequate validation of user-supplied strings in the firmware update process, enabling unauthorized code execution. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit physical access to the device.