Kenwood DMX958XR Command Injection Vulnerability in Firmware Update Process

A command injection vulnerability has been identified in the Kenwood DMX958XR model, allowing physically present attackers to execute arbitrary code with root privileges. This issue arises from inadequate validation of user-supplied strings in the firmware update process, enabling exploitation without authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code on the affected device, with root-level privileges.

Remediation

No official patch is available. The recommended mitigation is to limit interaction with the device.