Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code with root privileges. This issue arises from inadequate validation of user-supplied strings in the firmware update process, enabling exploitation without authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code on the affected device, with root-level privileges.

Remediation

The vendor is currently working on a fix, but no specific patch is available yet. In the meantime, it is advised to limit interaction with the device.