Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR device, specifically within the firmware update process. This issue allows physically present attackers to execute arbitrary code with root privileges on the affected device. The vulnerability arises from inadequate validation of user-supplied strings before they are used to execute system calls, creating an opportunity for code execution. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

The vendor has not released a patch for this vulnerability. The only recommended mitigation is to limit interaction with the product.