Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code on the device. This issue arises from inadequate validation of user-supplied strings in the firmware update process, enabling code execution with root privileges. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

The vendor is reportedly working on a fix, but no specific patch is available yet. In the meantime, it is advised to restrict interaction with the product.