Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code with root privileges. This issue arises from inadequate validation of user-supplied strings in the firmware update process, enabling unauthorized code execution. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

The vendor is currently working on a fix, but no specific patch is available yet. In the meantime, it is advised to limit interaction with the device.